Topics in this domain
- Risk Response Options: Accept, Mitigate, Transfer, Avoid
- Aligning Responses with Appetite and Tolerance
- Cost-Benefit Analysis of Risk Responses
- Bias in Risk Decisions and Reporting
- Risk Owners and Control Owners
- RACI and Escalation
- Third-Party Risk Governance and Due Diligence
- Contracts, SLAs and the Right to Audit
- Monitoring Third Parties and Planning Exit
- Managing Issues, Findings and Control Deviations
- Risk Acceptance, Exceptions and Exemptions
- Control Frameworks and Their Purpose
- Control Types and Functions
- Designing and Selecting Controls
- Implementing Controls and Why Implementations Fail
- Control Design versus Operating Effectiveness
- Control Testing: Objectives, Evidence and Frequency
- Building and Tracking Risk Action Plans
- Collecting and Aggregating Risk Data
- Validating Risk Data Quality
- KRIs, KPIs and KCIs
- Thresholds, Escalation Triggers and Appetite
- Metric Pitfalls and Misuse
- Continuous Monitoring versus Periodic Assessment
- Tailoring Risk Reports to the Audience
- Heat Maps, Dashboards and Scorecards
- Identifying and Assessing Emerging Risks
- Integrating Emerging Risk into Decisions
Control Testing: Objectives, Evidence and Frequency
Planning a test
Strength of evidence
Inquiry alone is never enough; combine methods.
How often to test
| Factor | Effect on frequency |
|---|---|
| High risk or key control | Test more often |
| Recent failures or changes | Test more often |
| Automated, stable control | Test less often, if change control is strong |
| Low risk, mature control | Test less often |
Evaluating exceptions
- What caused it: a one-off, or something systemic?
- Does it change residual risk?
- Is a compensating control in place?
- Who must be told, and what’s the fix?
Example. An access review test found 2 exceptions in 25. Both involved the same new manager, who hadn’t been trained. Training and a reminder fixed the cause; the risk rating stayed the same.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Weakest form of evidence | Inquiry |
| Strongest form of evidence | Re-performance |
| BEST basis for test frequency | Risk and importance of the control |
| Test finds exceptions | Investigate the cause and the effect on risk |
In short
- Start every test from the control objective: what risk must this control reduce?
- Testing methods range from inquiry (weakest) through inspection and observation to re-performance (strongest).
- Inquiry alone is never enough; combine methods.
- Sample size and test frequency rise with the risk and the control's importance.
- Exceptions must be investigated for cause and their effect on residual risk.
- Results go to control and risk owners and feed the risk register.
Exam traps
- Relying only on interviews as evidence.
- Testing every control with the same frequency regardless of risk.
- Ignoring exceptions because the overall pass rate looks high.
- Using a population that isn't complete.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Planning a test
Strength of evidence
1 / 8