Headline: Two Types of Control Testing — Design Effectiveness and Operating Effectiveness
The Two Types of Control Testing
Controls must be tested for both design and operating effectiveness. Both are essential for audit readiness.
Design Effectiveness Testing
Purpose: To determine whether a control is designed appropriately to mitigate the identified risk.
Definition: Is the control designed effectively to achieve its control objective?
Questions to answer:
- Does the control address the identified risk?
- Is the control designed to prevent or detect the risk?
- Is the control design consistent with regulatory requirements?
- Is the control clearly documented and understood?
How to test design effectiveness:
- Review control documentation
- Interview control owners
- Walk through the control process
- Compare to regulatory requirements
- Evaluate against best practices
When to test design effectiveness:
- When the control is first implemented
- When the control is redesigned
- When requirements change
- When risks change
Operating Effectiveness Testing
Purpose: To determine whether a control is operating as designed on a consistent basis.
Definition: Is the control operating as designed and is it effective on a consistent basis?
Questions to answer:
- Is the control being executed consistently?
- Is the control being executed as documented?
- Is the control achieving its objective?
- Is the control generating adequate evidence?
How to test operating effectiveness:
- Review evidence of control execution
- Observe the control being performed
- Reperform the control
- Test the completeness and accuracy of evidence
- Analyze exceptions and deviations
When to test operating effectiveness:
- Regularly (quarterly, semi-annually, annually)
- After changes to the control
- After changes to systems or processes
- When issues are identified
Design vs. Operating Effectiveness
|
Dimension |
Design Effectiveness |
Operating Effectiveness |
|
Purpose |
Is it designed right? |
Is it working right? |
|
Focus |
Control design |
Control operation |
|
When |
Design phase, significant changes |
Regular intervals |
|
Evidence |
Documentation, interviews |
Execution evidence, observations |
|
Outcome |
"This control should work" |
"This control does work" |
Testing Approaches
1. Walkthroughs
A walkthrough is a procedure that involves tracing a transaction from initiation through completion to understand the process and identify control points .
Example: Signal Corp. performed a walkthrough of each significant financial process and documented in a process flow diagram all the applications that supported these processes, including automated controls and controls that depended on system-generated reports .
2. Reperformance
Reperforming the control to verify it was executed correctly.
3. Inspection
Reviewing evidence of control execution.
4. Observation
Observing the control being performed.
5. Inquiry
Interviewing control owners and operators.
Control Testing Program
Elements of a control testing program:
|
Element |
Description |
|
Control inventory |
Complete list of controls |
|
Testing schedule |
When each control will be tested |
|
Testing procedures |
How each control will be tested |
|
Responsibility |
Who will test each control |
|
Documentation |
How testing will be documented |
|
Reporting |
How findings will be reported |
|
Remediation |
How issues will be addressed |
Conclusion
Control testing is essential for audit readiness. Organizations that test both design and operating effectiveness will have controls that are both well-designed and operating effectively.
Action Items for Your Organization
- Document your control testing program
- Test design effectiveness for new controls
- Test operating effectiveness regularly
- Use multiple testing approaches
- Document test results
- Address issues promptly
