Lesson 3.34: Testing a control: sampling and evidence
An auditor can't check every one of thousands of transactions, so they test a sample and draw a conclusion about the whole population. For that to be fair, the population must be complete, the sample chosen by a method nobody can steer, and every sampled item checked against the control's exact wording, with evidence. In the lab you audit Northwind's access-change control: count the population, draw a systematic sample, test approval order and segregation of duties, check that evidence exists, and write the finding.
18 min
You will learn to
- Explain population, sample and exception
- Draw a systematic sample
- Test a control's attributes on each sampled item
- Check that evidence exists for each item
- Write a finding with criteria, condition and conclusion
Key terms
- Population
- All items the control applies to in the period.
- Sample
- Items selected from the population for testing.
- Systematic sampling
- Selecting every n-th item from a fixed start.
- Control attribute
- One testable condition from the control's wording.
- Exception
- A sampled item where the control didn't work as described.
- Segregation of duties
- No single person can both request and approve the same action.
← One control, many frameworks · All lessons · Threat-led red teaming →