ASR-02 · Assurance and Evidence
Populations are complete
Where a control is tested by sample, the population is defined and its completeness can be demonstrated.
1frameworks fully address it
2partially
5leave it out
SOC 2 ISO 27001 NIST CSF PCI DSS HIPAA GDPR EU AI Act NIST AI RMF
1Where each framework asks for it
- SOC 2PartialCC4.1 Evaluation is required; population completeness is an audit expectation rather than a criterion.
- ISO 27001Partial9.2 Audit program requirements.
- NIST CSFAbsent The Framework describes outcomes, not testing method.
- PCI DSSFullTesting procedures
- HIPAAAbsent No testing methodology defined.
- GDPRAbsent No testing methodology defined.
- EU AI ActAbsent Not addressed.
- NIST AI RMFAbsent Not addressed.
Build the control once against this objective and cite the clause each auditor asks about. A partial mapping says what the framework leaves out; an absence is a finding about the framework, not a gap in your program.
2What usually proves it
Population definitions, extraction method, completeness argument.
?Why it exists
A sample from an incomplete population proves nothing.
For a smaller organizationSmall populations tested whole.