Control testing

An assessment test is a separate line tied to one assessment and one control. The tester records when the work was performed, the sample size, exception count, result and evidence reference. This keeps a failed sample from becoming only a general note on the assessment. The control code also appears on the test line for quick orientation during review.

For example, a team samples access approvals for a facility. If exceptions occur, the count cannot exceed the sample. A Pass needs an evidence reference. Fail and Inconclusive results can become findings tied to the actual tested control; Pending and Pass results cannot be used as the source of a finding. Testing advances the assessment through its Testing and Review states as appropriate.

• One accountable parent. Keep each activity linked to the relevant assessment, risk, control or finding so the next person can follow the same case.
• Named responsibility. Assign the record to the person who prepares the work and keep independent judgement with a separate reviewer where a decision is required.
• Visible outcome. Use the recorded state, result, date and evidence to explain what happened before moving the case forward.

Agree how the sample is chosen and how its evidence reference maps to the retained evidence. Define when an inconclusive result requires more work instead of being treated as a pass. Decide who tests a control owned by another person and who can review the result. These choices should be written before a period’s tests start.

Rehearse a sample with several exceptions, a zero-exception Pass and an inconclusive result. Check the evidence reference on the Pass. Try an exception count larger than the sample and reject it. Then register a finding from the failed test and confirm both assessment and control links.

Use a test of facility access approvals. The assessment owner records the number sampled, the number with exceptions and the evidence reference. A control owner can trace the test to the control actually selected in the plan. If the result is Fail or Inconclusive, the person registering a finding checks that its assessment and control match the test. Keep the original test result visible when the finding later moves into corrective work.

• Tests needing results — Pending control tests with their parent assessment and selected control.
• Failed and inconclusive tests — Tests whose recorded result needs a finding decision.

Follow the related process and check the record definitions.