Assertion
Also known as: Management representations, Control claims, Attestations
An assertion is a formal claim made by management regarding the reliability, accuracy, or validity of information and controls. It serves as the baseline that an auditor tests to determine if a statement is true or false. In security and data protection, assertions are explicit claims that specific controls are implemented and operating effectively.
In practice
A practitioner encounters assertions when reviewing a "Management Assertion" section in a SOC 2 report or testing a claim such as "all system changes are approved before deployment." The auditor then gathers evidence to either support or refute this specific claim.