Control Testing

A documented control is only a promise. A policy may say that every journal entry above a certain amount is reviewed, that departing employees lose access on their last day or that backups are checked each week, but that does not mean these things happen. Control testing finds out. Testers examine how each control is designed, then check samples of evidence to see whether it actually operated as described over a period of time. The results tell management, auditors and regulators whether they can rely on the control or whether it needs to be fixed. Testing also shows control owners where their procedures or evidence fall short.

Control testing is a core activity in SOX compliance, internal audit, SOC 2 examinations, ISO 27001 certification and regulatory reviews. It may be performed by control owners as self-assessment, by a compliance or risk function, by internal audit or by external auditors. Increasingly, technical controls are also tested automatically and continuously. For finance, audit, risk and security teams, well-planned control testing provides reliable assurance without consuming more time than necessary.

Definition of Control Testing

Control testing is the evaluation of a control's design effectiveness, meaning whether it is capable of addressing the relevant risk if performed as described, and its operating effectiveness, meaning whether it actually operated consistently as designed throughout a defined period.

Testing checks internal controls documented in a risk control matrix and is a central activity of internal audit.

Design and Operating Effectiveness

A test of design asks whether the control, if it works as described, would prevent or detect the risk it is meant to address. It is often done through a walkthrough, following one transaction from start to finish.

A test of operating effectiveness asks whether the control actually worked as designed during the period, usually by examining a sample of instances. The period tested should match the period over which the organization wants assurance, such as a financial year.

A control must pass both tests to be relied on. A well-performed control with a poor design still leaves the risk unaddressed.

Design is usually tested first, since there is little point testing the operation of a control that would not work even if performed perfectly.

Testing Methods

Inquiry involves asking control owners how the control works. It is useful for understanding but is not sufficient evidence on its own. It should always be combined with stronger methods.

Observation involves watching the control being performed, which shows how it works at that moment but not over time. People may also perform a control more carefully when they know they are being watched.

Inspection involves examining evidence, such as signed approvals, review notes, system reports or tickets, to confirm the control was performed.

Reperformance involves the tester independently carrying out the control to confirm it produces the right result, which provides the strongest evidence.

Sample sizes usually depend on how often the control operates. A widely used practice is to test one instance of an annual control, two of a quarterly control and larger samples, often 25 or more, for controls performed daily or many times a day.

Importance of Control Testing in Risk and Compliance

Control testing provides assurance. Leaders, auditors and regulators can rely on controls that have been tested, rather than on descriptions alone. Tested controls also give the board more confidence in reported results.

It finds weaknesses early. Testing during the year allows deficiencies to be fixed before year-end reporting or an external audit.

It also improves controls. Testers often identify unclear procedures, missing evidence and controls that no longer fit the process. Their recommendations often make controls simpler as well as stronger.

Control Testing and Financial Management

Testing consumes significant staff and auditor time, so focusing on key controls over material risks keeps costs proportionate.

External auditors may rely on high-quality management or internal audit testing, which can reduce audit fees.

Automated controls generally need smaller samples than manual controls when supported by effective IT general controls, reducing testing effort.

Finding a deficiency early through testing is usually far cheaper than discovering it through a misstatement, loss or regulatory finding.

Common Challenges

Evidence is often incomplete or missing, so controls that were probably performed cannot be shown to have operated. Clear evidence requirements in each control description prevent this.

Testing can focus on whether a box was ticked rather than whether the review was meaningful, such as whether exceptions were investigated. Testers should look at what the reviewer actually did, not just that they signed.

Several teams may test the same controls separately for different frameworks, duplicating effort. Agreeing a shared testing approach can satisfy several frameworks at once.