Control testing
Also called controls testing, test of controls, control assurance testing
Control testing checks whether a firm's internal controls are designed properly and work as intended over time. Testers review how each control should operate, then take samples of real activity to confirm it did. Results show where risks are not being managed and feed into remediation, risk reporting and board attestations.
How it works
At a bank, controls range from payment approvals to sanctions screening checks. Testing has two parts. Design testing asks whether the control, if followed, would address the risk. Operating effectiveness testing samples transactions over a period to see if it was actually performed. The first line tests its own controls, compliance and risk functions run independent checks, and internal audit gives assurance.
Failed tests become findings with owners and deadlines. Results feed risk and control self-assessments, regulator reviews and public statements on internal control. US listed companies certify internal control over financial reporting under SOX. UK companies in the commercial companies category declare the effectiveness of material controls for financial years from 1 January 2026, on a comply or explain basis. Continuous automated testing is replacing some periodic sampling.
The rules
Requires management to assess internal control over financial reporting each year and, for larger filers, an auditor attestation on that assessment.
US-listed companies and their external auditorsSets how auditors test the design and operating effectiveness of controls over financial reporting.
Auditors of US public companiesBoards declare the effectiveness of material controls at the balance sheet date and describe any that did not operate effectively.
Companies in the UK commercial companies or closed-ended investment funds listing categories, on a comply or explain basisCommon questions
What is the difference between design and operating effectiveness?
Design effectiveness asks whether a control, performed as written, would prevent or detect the risk it targets. Operating effectiveness asks whether people or systems actually performed it consistently over the period. A control can be well designed yet fail in operation.
Who performs control testing in a bank?
Under the three lines of defence model, business units test their own controls, risk and compliance functions carry out independent monitoring and testing, and internal audit provides assurance to the board. External auditors also test controls relevant to financial reporting.
How many samples are needed in control testing?
Sample sizes depend on how often a control runs and the risk involved. Annual controls may need one sample, while daily or transaction-level controls need far more. Firms set sampling methodologies in their testing standards, often aligned with audit practice.
What is continuous control monitoring?
Continuous control monitoring uses automated checks on full data sets rather than periodic manual samples. It tests controls such as access rights or payment approvals in close to real time, so failures surface sooner. Firms usually combine it with manual testing for judgement-based controls.
Our coverage
News and analysis on GRC and resilience from RegTech Post.
Read the coverage →RegTech PostThe Future of GRC Platforms: AI, Automation, and Risk PredictionRead the article →RegTech PostSarbanes Oxley Workflows Shift as Regtech Adoption JumpsRead the article →
