Control testing

Each assessment test belongs to one assessment and one control. The Assessment Owner records when it was tested, the sample size, exception count, evidence reference and result. A result can be pending, pass, fail or inconclusive. The evidence reference makes the conclusion checkable by another person without moving the test to a different assessment or control.

The testing workflow rejects an exception count larger than the sample and refuses a passing result that has no evidence reference. It can move the parent assessment into testing or review after recording the test. A failed or inconclusive result may then be the source for a finding. A passing or pending test is not a valid source for that finding workflow.

• Sample rule. Agree what makes an item eligible for the sample and when an exception is counted.
• Evidence reference. Use a stable reference that the reviewer can open in the agreed document location.
• Result meaning. Decide when an incomplete sample is inconclusive rather than passed or failed.

The Assessment Owner and Compliance Manager should rehearse how this work is assigned and reviewed. Agree which organization and business unit own the first case, who may update it, and where its supporting evidence lives. Set a clear handoff when the person preparing the record is different from the person checking its outcome. Use the same rule for routine work and exceptions so an urgent item does not lose its owner or history.

For the pilot, agree what constitutes one sample item and one exception on the selected control. Keep the evidence reference usable by the Compliance Manager. Test an oversized exception count and a pass without evidence before recording the failed result that will become a finding.

Take a scoped control test and enter a sample with an exception count within its size. Add the tested date and evidence reference, then record a failed result. Open the test from its assessment and confirm the control relationship. Next, try a pass without evidence and an exception count greater than the sample; both requests should be refused. Register a finding from the failed result and verify that it carries the same assessment and control.

From Failed control tests, open the failed result and compare its sample, exceptions and evidence reference with the linked finding. If testing times out, inspect the existing result and receipt before retrying. The second request should not replace the first observation.

• Failed control tests — Failed samples with exception counts and evidence references.
• Tests requiring evidence — Pending and inconclusive tests that need follow-up.

See the related process for the stage-by-stage handoff. Use the data model to inspect the record relationships and implementation to plan the first rehearsal.