Control Testing

A Control Tester records a test against an assessment and a specific control. The test has a tested date, sample size, exception count, result and evidence reference. Those details make a pass or fail reviewable. The reviewer can compare the recorded exceptions with the conclusion and ask for more evidence when the sample does not support it.

For example, a tester samples branch reconciliations for the current reporting period. If several selected items have exceptions, the tester records that count and the evidence reference alongside the result. A failed result can lead to a finding linked to the same control and assessment. An inconclusive result remains a real result: it tells the reviewer that the evidence has not established a pass or fail.

• Assessment link. Each test belongs to the period and scope recorded on its parent assessment.
• Control link. The tested control identifies the underlying risk and accountable owner.
• Evidence and outcome. Sample size, exceptions, result and evidence reference let a different person inspect the conclusion.

Agree what a sample represents for each control and how the tester should count exceptions. Decide what evidence reference format points to the underlying item, and when an attachment should be kept on the assessment. A reference that another reviewer cannot open or identify is weak support for a test conclusion.

Separate the person performing the test from the person making the independent assessment decision. The team should decide how to handle an incomplete sample and when to mark a test inconclusive. Set a convention for recording a failed test as a finding so the remediation owner can see the issue without interpreting test notes alone.

Take a planned assessment with an active linked control. Record a test date, sample and exception count, then add a result and evidence reference. Attach supporting material to the assessment where appropriate. Have the Independent Assurance Reviewer follow the test to its control and inspect whether the evidence supports the result. Repeat with an inconclusive result and ask the reviewer to identify what additional evidence would resolve it.

If the test fails, create a finding with a severity and description. Confirm that the finding points back to the same assessment and control. The remediation team should be able to read the issue and assign a corrective action without reconstructing the tester’s private notes.

• Tests awaiting a result — Find test records still waiting for a conclusion.
• Failed control tests — Review failures and inconclusive results with their sample details.
• Assessment status board — See which assessments are still in testing.

The scope and testing process takes the test through review. Follow findings and retests when a control needs corrective work.