How to Perform Control Testing
Performing control testing is the process of evaluating whether controls are properly designed and operating effectively. This guide walks through the steps to conduct control testing that provides meaningful assurance about the control environment.
Step 1: Identify Controls to Test
Not all controls need to be tested every period. Identify which controls to test based on: risk (key controls first), changes (controls that have been modified), past failures (controls with prior deficiencies), and regulatory requirements (controls mandated by regulation). A risk-based testing plan ensures resources are focused where they matter most.
Step 2: Understand the Control
Before testing, understand the control: what risk does it mitigate, how is it designed to work, who performs it, when is it performed, and what evidence does it produce. Walk through the control with the control owner to understand how it operates in practice. This understanding is essential for designing an effective test.
Step 3: Design the Test
Design a test that evaluates both design effectiveness (is the control properly designed?) and operating effectiveness (is it operating as designed?). Choose the testing method: inquiry (interview), observation (watch the control being performed), inspection (examine documentation), re-performance (independently perform the control), or walkthrough (trace a transaction through the process). The method depends on the control type.
Step 4: Execute the Test
Execute the test according to the design. For inspection, examine a sample of control evidence. For re-performance, independently perform the control and compare results. For observation, watch the control being performed. Document the test procedure, the sample size, the test results, and any exceptions found. Be thorough and objective.
Step 5: Evaluate Results
Evaluate the test results: did the control operate as designed? Were there exceptions? If so, were they isolated or systemic? Rate the control: fully effective (no exceptions, operating as designed), partially effective (some exceptions but generally operating), or ineffective (systemic failures). Document the evaluation with supporting evidence.
Step 6: Document Deficiencies
If the test reveals deficiencies, document them: what is the deficiency, is it a design deficiency or an operating deficiency, how significant is it, and what is the potential impact? Classify the deficiency: deficiency, significant deficiency, or material weakness. Create remediation actions for each deficiency with owners and due dates.
Step 7: Report and Follow Up
Report test results to stakeholders: control owners, risk function, management, and the audit committee if material. Track remediation actions through to completion. Re-test deficient controls after remediation to verify effectiveness. MPG tracks control testing, deficiencies, and remediation with full audit trails.
Key Takeaways
- Use a risk-based approach to determine which controls to test
- Understand the control before designing the test
- Test both design effectiveness and operating effectiveness
- Document test procedures, results, and any deficiencies
- Track remediation of deficiencies through to completion and re-test
Frequently Asked Questions
What sample size should we use for control testing?
Sample size depends on the control's risk, the population size, and the desired confidence level. For key controls, typically 25-60 samples are tested. For lower-risk controls, smaller samples may suffice. Statistical sampling methods can determine the appropriate sample size. MPG supports risk-based sample sizing in its control testing module.
What if we find a control is ineffective?
Document the deficiency, assess its impact on the risk it mitigates, determine if compensating controls exist, and create a remediation plan. If the deficiency is material, escalate to senior management and the audit committee. Update the residual risk calculation to reflect the control's ineffectiveness. MPG tracks deficiencies through to remediation with full audit trails.