Control Effectiveness Testing

Testing looks at a control from two angles. Design testing asks whether the control, if carried out as written, would address the risk. Operating testing asks whether it was in fact carried out, by the right person, on time and every time over the period. Testers use enquiry, observation, inspection of records, re-performance of the check, and for automated controls, a test of the system setting plus the general controls around it. Samples are drawn from the population, with larger samples for higher risks and frequent controls. Results are rated as effective, partly effective or ineffective, and failures feed the control deficiency process and updates to residual risk. Testing is done by the first line, by second-line compliance or risk teams, and by internal audit. A control that exists only in a procedure manual usually surfaces here as an exception.

An insurer requires a second person to approve any change to a policyholder's bank details. A tester pulls 25 changes from the year, checks that each shows a different approver, and finds three approved by the same person who made the change. The tester rates the control partly effective, reports the exceptions, and the owner retrains staff and tightens the system rule.