Control testing

The Control Tester records each test line under an assessment and links it to the control tested. The line has a tested date, sample size, exception count, result and evidence reference. The result choices distinguish pending work, a pass, a fail and an inconclusive result. A file can be attached to the assessment as supporting material with a title, type, uploader and visibility. The assessment moves through planned, testing and review states as the work progresses.

• Source record. Start with the assessment, risk or finding that owns the work and follow its references before changing a status.
• Named responsibility. Use the linked owner or reviewer so the next action is accountable to a person in the organization.
• Recorded result. Retain the date, status, decision or evidence that explains why the work moved forward.

The Operations Overview helps the team see assessments, tests, decisions and failed operations in one context. Open the underlying record before acting, especially when two assessments have similar subjects. The record number, organization and period should identify the intended case. Decisions and retests should point back to the source they cover.

Agree what constitutes a sample, how exceptions are counted and when an inconclusive result needs another test. Decide what the evidence reference points to and who may see an internal attachment. Keep the test date separate from the upload date so later reviewers can reconstruct when work occurred. The team should rehearse these choices with a small, recognizable case before widening access. A named owner should check that a reviewer sees the right case and that a person outside the case cannot change it.

For an access review, the Control Tester samples approvals, counts the exceptions and records the result against the actual control. If an exception fails the test, the tester opens a finding tied to that assessment and control. The reviewer can inspect the sample result and attachment before deciding whether the assessment is ready for sign-off. Walk the record from its first entry to the next person’s action. Check that dates, references and status tell the same story, and that evidence is available to the authorized reviewer. If the work is corrected, preserve the earlier result and the reason for the change. The team can then use the same handoff for a second case without relying on a side conversation.

• Test Results — Pending, failed and inconclusive results with sample details.
• Assessment Periods — The period and owner for current testing.
• Evidence Register — Supporting files and their visibility.

Each view opens records with the fields needed for that decision. The person working the queue can compare the current status with the linked source, then open the record for its full history. A board or due-date list helps prioritize, while the recorded decision remains on the case.

Follow assessment preparation, testing and findings, independent review and verified closure. Start with the process that owns the record on this page, then inspect the next handoff before releasing work to another role.