Controls and assurance
Compliance Control Design and Testing
How to design controls that address a real failure mode and test whether they work.
Why this matters
How to design controls that address a real failure mode and test whether they work.
Start with the failure mode
A control should respond to a defined risk event. Identify the point where failure can be prevented or detected, the information available at that point and the person or system able to act.
Design attributes
Document the objective, owner, frequency, population, inputs, steps, evidence, exception handling and escalation. State whether the control is preventive, detective or corrective and whether it is manual, automated or dependent on system configuration.
Design effectiveness
A design review asks whether the control, if performed as described, would reasonably address the risk. It also checks segregation of duties, completeness of inputs, precision of thresholds and handling of exceptions.
Operating effectiveness
Operating testing examines whether the control actually ran over the review period. The tester selects a population or sample, examines evidence, records exceptions and determines whether failures are isolated or systemic.
Testing discipline
Define pass/fail criteria before testing. Preserve the population, sample rationale, evidence and conclusion. A control should not be rated effective merely because the owner says it normally happens.
Questions to document
- Which obligations and processes are in scope?
- Who owns the activity and who independently reviews it?
- What record demonstrates that the activity operated?
- What happens when the control fails or circumstances change?
Related planning tools
Use the local planning tools to turn the concepts into a structured working note.