Control testing

A control test belongs to an assessment and points to the control being checked. Its test date, sample size, exception count, result and evidence reference tell the next reader what happened. The line number and revision help keep a repeated or corrected test distinct from an earlier entry. A failed result is a starting point for a finding, not a substitute for investigating its cause.

Suppose a Tester checks a sample of approvals for a control. They record the size of the sample, count the exceptions and add the reference that takes a reviewer to the supporting material. A Pass, Fail or Inconclusive result states the tester’s conclusion about that run. If the evidence is not ready, Pending keeps the result visible without implying a completed check.

• Select. The Tester works from the assessment scope and the control’s description and effective date.
• Record. Each test run captures the sample, exception count, date, result and evidence reference.
• Respond. A failed result is examined as a finding linked to the control and assessment.

Agree what makes a sample large enough for each type of control and how evidence references are formed. The text reference must let an authorized reviewer find the material in the organization’s chosen repository. Decide when an Inconclusive result should trigger another test rather than an immediate finding. The team should also agree who may correct a test and how the revised entry is identified.

A control can be tested more than once in an assessment. The line number and revision help distinguish those runs; the test date and result explain sequence. A later passing test should not erase an earlier failed result. The assessment owner needs both to understand why the work moved into remediation.

Ask the Tester to run one check for an active control. Confirm that the control code on the test matches the linked control, the assessment belongs to the intended organization and period, and the evidence reference opens the material the tester used. Compare the sample size with the exception count; a reviewer should be able to understand the conclusion from the actual check.

Now use a failed case. Record the finding against the same control and assessment, including severity, description and opening date. The Compliance Lead reviews the issue before assigning corrective work. After the correction, an Independent Reviewer records a separate retest against the finding. The original failed test and the later retest answer different questions and remain visible together.

• Failed tests — Failed results with their sample, exception count and evidence reference.
• Assessments in progress — The assessment context for testing and review.

See testing and remediation and assessment cycle.