Control testing

Each assessment test belongs to an assessment and a control. Its line number and revision keep it in the plan that the owner prepared. The tester records when testing occurred, the sample size, the exception count, the result and a reference to evidence. Pending, Pass, Fail and Inconclusive describe different outcomes; they should not be grouped into a single completed state.

Suppose the team samples payment approvals for a quarterly assessment. The sample size is the denominator for its exceptions. An exception count greater than the sample cannot be an accepted result. A passing result needs an evidence reference, so another person can examine the basis for the conclusion. If the evidence is incomplete, Inconclusive may be more faithful than Pass.

• Planned line. Keep the test tied to the assessment revision and selected control.
• Observed result. Record the sample, exceptions, date, evidence reference and result together.
• Exception path. A failed or inconclusive test can lead to a finding on the same assessment and control.

Agree what constitutes a sample, when a test can be concluded and how the evidence reference resolves to a document or system of record. Set a naming convention for test lines so reviewers can compare the planned set with the executed set. Decide when the assessment moves from Testing to Review and who confirms that all intended lines have an outcome.

Evidence files can be attached to the assessment with a visibility choice. The attachment title, type, uploader and upload date should let the reviewer find the right item. A text reference on the test and an assessment attachment serve related purposes, but the team should agree how they point to the same evidence. Keep Internal material within the approved access scope.

Rehearse a test with a sample of twenty items and two exceptions. Record the date and evidence reference, then mark it Fail. Trace the resulting finding to this exact test’s assessment and control. Repeat the test submission with the same operation identifier and confirm it does not create another result or finding.

Try to record twenty-one exceptions against the same sample and a Pass with no evidence reference. Both should be refused before the reviewer receives the case. The reviewer should see the original plan, the observed result and the evidence path. A Pending test remains visible so a status change on the assessment does not hide unfinished examination.

• Control test exceptions — Examine failed and inconclusive results with their sample and evidence reference.
• Pending control tests — See planned lines that still need an outcome.

Follow a test into remediation and review evidence handling.