Lesson 3.25: Testing controls: design and operating effectiveness
Assurance asks two different questions about every control. Is it designed to address the risk (design effectiveness)? And does it actually run as designed, every time, over the period (operating effectiveness)? A badly designed control fails even when performed perfectly; a well-designed one fails when people skip it. Findings are rated by severity so leadership knows what needs its attention. In the lab you review three controls' designs, test samples of their operation, judge an emergency change, rate the deficiencies and write the results.
20 min
You will learn to
- Tell design effectiveness from operating effectiveness
- Count exceptions per control from sample results
- Judge exceptions against the control's own rules
- Rate deficiencies by severity
- Write testing results for governance
Key terms
- Design effectiveness
- Whether a control, if performed as described, would address the risk.
- Operating effectiveness
- Whether the control actually operated as designed throughout the period.
- Exception
- A sampled instance where the control didn't operate as designed.
- Deficiency
- A control that isn't designed or doesn't operate as intended.
- Key control
- A control a significant risk depends on.
← Governing the use of AI tools · All lessons · A sector-wide supplier incident →