Control testing

Each test belongs to an assessment and a control. The tester records when it was performed, the sample size, exception count, result and evidence reference. Line number and revision help distinguish one test from another when the assessment is updated. This record gives the reviewer more than a pass or fail label: it shows the scope of the test and the basis for an exception.

A failed result can lead to a finding linked to the assessment and control. An inconclusive result stays distinct from a pass. The owner can add an attachment to the assessment with a title, evidence type, upload date and visibility. The upload record names the team member who supplied it. The team must keep the attachment and test reference aligned during review.

• Test. Record the control, test date, sample size, exception count and result.
• Evidence. Use the evidence reference and assessment attachment to support the observed result.
• Exception. Open a finding when the failed scope needs a tracked corrective action.

Define sampling expectations for the first operating cycle. Agree when an exception count changes a result to fail, and what evidence is required for a pass, fail or inconclusive result. Set the visibility rule for shared and internal attachments, including who may read each category. Decide who verifies that the test’s control code still matches the linked control.

Choose a small, realistic test set for a rehearsal. Have the Assigned Tester record both a passing and a failing case. The reviewer should follow each test to its control and assessment, then locate the evidence. For the failed case, raise a finding with its own description, severity and opened date. This keeps the finding separate from the raw observation.

Suppose a tester samples approval records for an active control and finds exceptions. They record the sample size, exception count, date and failed result, then identify the evidence. The Control Owner opens a finding against the same assessment and control. The Independent Assurance Reviewer can inspect the attachment and compare the test to the planned scope before deciding on the assessment revision.

If the evidence is incomplete, retain the inconclusive result until the tester resolves it. Do not turn an absence of support into a pass merely to close the review queue.

• Failed tests — Sample and exception detail for results marked failed.
• Review queue — Assessment revisions awaiting independent assessment.
• Open findings — Exceptions with severity and status for follow-up.

See assessment and testing and remediation and retest.