Evidence and testing

Every control in the control matrix leaves its own record as it runs. Nothing has to be collected by hand, and every report can be produced again later, figure for figure.

The records

Record	Proves	Where to get it
Operations	Who asked for each act, by subject, name and email, under which role, and the ledger transaction it became	`GET /v1/operations`; the hash-chained audit log, `GET /v1/audit-log`
Approvals	Who approved each sensitive act, by subject, name and email, and that they were not its maker	`GET /v1/approvals`; the audit log
Policy versions	Every rule in force at any time, who approved it, when it took effect	`GET /v1/instruments/{instrumentId}/policy-versions`
Credentials and claims	Who was eligible when, verified against which evidence	`GET /v1/holders`; the holder’s record, `GET /v1/holders/{holderId}`
Restrictions and holds	What the venue stopped, why, by whom, and who released it	Control events; the holder’s and the asset’s records
The block list	Whom the register keeper blocked on the registry, and when	The register keeper’s own node
Consents and agreements	What the register keeper agreed to in advance: its consents to the primary market and to each reserve, and its standing agreement to forced transfer and recovery	The ledger, on each signatory’s node
Reconciliation runs	What was compared, what was found, how each finding was cleared	`GET /v1/reconciliation-runs`
Ledger transactions	What moved, and who signed it	Each party’s own node; the operation names the transaction
The event feed	Everything above, in order	`GET /v1/events`; signed webhooks

The auditor role reads everything the venue keeps, and writes nothing; the block list is the register keeper’s, read on its own node. Every read names the point on the ledger it was read at, so a report produced today can be reproduced later.

A test plan

Test the design: walk through each family page with the control matrix, confirming that each risk has a control, and each control an owner and a record; and confirm the shared-responsibility table names a party for every part the matrix leaves out.
Test who decides: for a sample of mints, burns, block-list entries and forced moves, confirm the register keeper’s signature, or the consent or agreement it signed that the act ran under.
Test operating effectiveness: for the period, sample each control’s records using its “How to test” column. For example:
- four eyes: sample operations and confirm distinct makers and approvers;
- loosened policies: confirm two approvers and the delay, and, for the supply terms, the register keeper’s acceptance;
- reconciliation: confirm runs on schedule, each blocking finding released by two approvers with a reason, and each reserve’s cover recomputed from its reports;
- forced transfers: match each move to its consent, the register keeper’s agreement in force, and its order’s hash.
Reperform: recompute a sample of payments, payouts and distributions from their units and prices (Pricing), and the cap table at a chosen point from the ledger.
Test privacy: read a sample investor’s view and confirm it shows nothing of other investors.

The story

Control families

For auditors

Evidence and testing

The records

A test plan

​The records

​A test plan

The records

A test plan