Control testing

Each test belongs to an assessment and a named control. The test can carry its line number, revision, date, sample size and exception count. The result distinguishes pending, passed, failed and inconclusive work. An evidence reference gives the reviewer a path to the material behind that result; a blank or inconclusive result should not be treated as a pass.

For a failed test, the Control Owner can inspect the linked control and raise a finding describing the deficiency. The reviewer looks at the test result alongside the exception count and evidence before accepting the assessment outcome. If the team changes a test record, preserve the revision context so the earlier reviewer decision remains explainable.

• Select the control. Use the control linked to the assessment test and check its effective date.
• Record the sample. Keep the test date, sample size, exception count and result together.
• Explain an exception. Supply an evidence reference and raise a finding when a failed result needs correction.

Set a rule for choosing the control that applies to the assessment period. Agree how testers record an inconclusive result and what evidence reference the Independent Assurance Reviewer needs to inspect a failure. Decide who compares exception count with sample size before the assessment moves into review. Keep the test revision and parent assessment visible when a result changes.

Have the Control Owner enter a test against a named control with a sample size, exception count and evidence reference. Record a failed result and open a finding against the same assessment and control. Ask the Independent Assurance Reviewer to follow the reference to the evidence and confirm that missing material is never treated as a pass. Repeat with an inconclusive result and ask the owner to explain what further work is needed before the assessment can be reviewed.

• Tests awaiting result — Find tests that still need a recorded result and evidence.
• Failed control tests — Inspect exceptions and the supporting control before remediation.

During rehearsal, use one passed test and one failed test against different controls. Ask the reviewer to find the sample size, exception count and evidence reference for each. An inconclusive result deserves an explanation and a next action; it should remain distinct from both a pass and a failure in the review queue.

See the related process and the record model before agreeing the pilot.