The Premise Test

Silent Expiry is present when, and only when, three conditions hold together §

1. A reason existed. The control was instituted because of a state of the world that justified it, and that state was real at the time.
2. The premise lies outside the control’s verification. What persists is the control and its documentation. The premise may be recorded elsewhere, and the organization may know it — what defines the condition is that no artefact the control’s own verification consults, and no question that verification asks, tests whether the premise is still true.
3. The failure is mute. When the premise ceases to be true, the control does not break, stop, or alarm, and no signal attributable to that premise’s failure reaches the verification loop of that control before its next relevant verification point. A warning received and not acted on is a failure of response, not Silent Expiry.

For interval, threshold and trigger controls the state often appears as compliant non-execution: the control stays in force, the check correctly returns “not due”, and the task never arrives. A fourth fact explains why the state persists: standard verification interrogates the record or the execution, never the premise. Detection changes the exposure, not the phenomenon.

Three questions for any control §

Date

Can you say when the premise would have stopped being true?

Witness

Who, outside the control’s owner, would actually know?

Counterfactual

If it were false today, would anything alarm, or would the control keep running?

The third question finds the ones that matter. If it goes quiet, you have found one.

What to write down §

For each control that matters: the premise, as one proposition; the date it was last known true; the person who would know if it fell; and whether anything would currently reveal it. That record is what an organization would show if asked to demonstrate that it identifies Silent Expiry.