Testing and evidence

Testing turns a planned assessment into a set of observable results. Each Assessment Test belongs to an assessment and a control. Record when the sample was tested, its size, the exception count and the result. An evidence reference gives the reviewer a way to connect the result to the underlying material. Assessment attachments hold files with an evidence type, upload date and visibility choice.

A pass, fail or inconclusive result should describe the sample actually examined. The exception count is a recorded observation, not a legal conclusion. If the sample is incomplete, use the inconclusive result and explain what further evidence the team needs. The Assessment Owner coordinates the work; the Control Owner helps interpret what the control was designed to do. The Compliance Manager uses the test record during review.

For example, a team checking time records for a defined period can record the sample size and hours exceptions in a test connected to the applicable control. They attach a supporting file to the parent assessment and use the evidence reference to identify the relevant source. If the test fails, the finding can point back to that assessment and control without forcing the reviewer to reconstruct the chain from email.

• Test record. Keep the tested control, sample size, exception count and result together.
• Attachment context. Set the evidence type and visibility for files on the assessment.
• Review trail. Use the assessment and control links to move from result to finding.

Agree how samples are selected, what an exception count means for each test, and how evidence references are named. Decide which files are internal and which can be shared. Review access to attachments with the actual people who will upload and examine them. A filename alone should not have to carry the entire explanation of a test result.

Run a small test on one assessment and record a clear result. Attach the source material, then ask a different reviewer to locate the material from the test record and explain the exception count. Repeat with an inconclusive case and verify that it remains visible for further work. Check that the record remains tied to the correct assessment after the team opens another period.

• Test exceptions — Failed and inconclusive tests with their sample and evidence reference.
• Assessments in progress — Active assessments where tests are being recorded.
• Assessment review inbox — Assessment revisions awaiting review of their results.

Follow the related process, review the data model and agree implementation steps with the team.