6.1 Testing control effectiveness

Testing design effectiveness usually requires a systematic review of controls to decide whether there is an issue. Typical tests would include: reviewing the design documentation to look for potential gaps or errors; inquiry of management or subject matter experts; and observation of the process or control environment.

Testing operational effectiveness involves reviewing the activity within the organisation at its point of use. Typical tests would include: re-performance of the control; review of documented evidence of the control operating at a specific time point; or inquiry of management or subject matter experts.