Testing and Findings

Each test line belongs to an assessment and points to a control. The Control Owner records when it was tested, the sample size, exception count, result and evidence reference. A pending result means the line still needs an outcome. Passed, failed and inconclusive results each mean something different to the reviewer, so the team should agree what evidence supports each choice before the first review cycle.

A finding identifies an assessment and control, with a description, severity and opened date. It can move through open, action planned, retest and closed stages. This keeps a failed control result connected to the follow-up work instead of losing it in a separate action list. The assessment remains the parent context for the finding.

• Test line. Use the control code and link to identify exactly what was examined.
• Result. Record the test date, sample size, exceptions and evidence reference together.
• Finding. Give a material issue severity and a clear description tied to the assessment and control.

Define what counts as a sample and an exception for each control family. Decide when an inconclusive result needs another test and when a failed result should open a finding. Make the evidence reference usable by a reviewer who did not perform the test. The finding description should explain the observed issue, while the severity gives the team a way to order attention.

For a control test with several exceptions, the owner records the sample and exception counts and marks the result. A finding can then cite the same control and assessment. The reviewer can inspect that path and ask for the underlying evidence before accepting a corrective plan. A case should not rely on a number alone to explain why the result was chosen.

Choose an assessment in testing and find one pending test and one completed test. Confirm both point to controls in the assessment scope. For the completed test, inspect its evidence reference, date and exception count. If it failed, open the finding and confirm the severity, description and control link tell a coherent story. Ask someone outside the testing team to reproduce that story from the records.

Then carry the finding into a corrective action and independent retest. The follow-up should remain attached to the original assessment and control so the reviewer can distinguish the first failure from later evidence. Revisit the assessment status when tests are ready for review; the status should reflect the work actually done.

• Pending Control Tests — Find test lines waiting for a result and evidence reference.
• Open Findings — Track issues from opening through action planning and retest.

See control testing and remediation.