Evidence of control operation

1. Regulatory Concept & Core Standards

This video focuses on how to assess actual implementation through a sample. Follow the sequence of decisions in the example rather than simply memorising a list. Notice who is involved, what information is needed and the expected result. These points help turn the content into a practice that another person can verify. Audit evaluates specified criteria and evidence within a defined scope. This methodology is recommended and confers no statutory certificate. Confidentiality and privacy also apply to auditors. Conclusions must fit the period, sample and processes reviewed.

Operational evidence may show acknowledgements, permission reviews or completed corrections. It requires reliable sources and interpretation. Missing records may mean undocumented work or unperformed work, requiring clarification. Entire case contents are not always necessary.

Apply the following rule: Section 10(3) prescribes three years and refers to feedback under section 11(4), while final-outcome feedback now appears in section 11(6). Do not conceal the cross-reference issue or automatically replace it with receipt. Document the legally confirmed starting event before automating deletion. Government Regulation 12 of 2 February 2026 covers the report, collected material and media, review of oral-report minutes and destruction under a procedure approved by the organisation’s head.

2. Practical Implementation & Procedure

Choose a risk-based sample. Check event times and relevant grounds. Compare sources, note limits and obtain proportionate clarification before concluding. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.

3. Case Study & Compliance Action

A system shows timely acknowledgement but no sending log. The auditor checks whether it occurred or was manually marked rather than treating status as conclusive. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.

The exercise is as follows: Does a green status alone establish compliance? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.

Not always. Understand how it arose and the underlying event. Evidence must match the criterion.

One mistake to avoid is: accepting status without corroboration.

Now apply the national rule to a second decision. The system deletes every case five years after receipt. Is that correct for Estonia?

No. The three-year period in section 10(3) references feedback rather than automatically receipt. The current cross-reference issue needs a documented legal resolution. Apply Regulation 12 and privacy rules to related material and copies. Do not keep everything indefinitely without grounds.