# Continuous control testing

URL: /systems/trust-and-governance/controls/continuous-testing · Id: `control:continuous-testing`

> Each automated control’s test runs daily over its whole population and records its result against a published root.

Each automated control’s test runs daily over its whole population and records its result against a published root.

## Satisfies
| Criterion | Text |
| --- | --- |
| [SOC2 CC4.1](/systems/trust-and-governance/criteria/soc2/cc4-1) | The entity performs ongoing or separate evaluations to confirm that the components of internal control are present and functioning. |
| [ISO27001 A.5.36](/systems/trust-and-governance/criteria/iso27001/a-5-36) | Compliance with the information security policy, rules and standards is reviewed on a set schedule. |
| [HIPAA 164.308(a)(8)](/systems/trust-and-governance/criteria/hipaa/164-308-a-8) | The entity evaluates on a set schedule how well its security policies and procedures meet the rule. |

## Implemented by
- [Compliance](/workflows/processes/compliance)
- [Control testing](/workflows/processes/compliance/evidence-collection)
- [Compliance](/systems/compliance)

## Test
| Step | Rule |
| --- | --- |
| Kind | Detective: it finds the failure after it happens. |
| Select | Every day of the report period, for each automated control. |
| Assert | Each day has a `Control.tested` Event citing a root, a sequence range, counts and exceptions. |

## Owner
[Compliance Officer](/agents/legal/compliance-officer), [Legal Team](/agents/legal).

## Example
Each night the one-way windows test reads every one-way [Action](/business/nouns/action) from the day. It records a `Control.tested` [Event](/business/nouns/event) with the published root, 1,412 Actions checked and zero exceptions.