COSO Control Testing: A Practical Guide
A practical guide to COSO control testing, covering design effectiveness, operating effectiveness, evidence, sampling, exceptions, deficiencies, remediation, retesting, and assurance coordination.
Key Takeaways
- ✓Start testing with the objective, risk, and control purpose.
- ✓Evaluate design before relying on operating effectiveness results.
- ✓Define criteria, population, sampling, evidence, and conclusions clearly.
- ✓Document exceptions and assess whether they represent deficiencies.
- ✓Connect testing results to the risk control matrix and remediation.
- ✓Retest remediation when required.
COSO Control Testing: A Practical Guide
Control testing provides evidence about whether controls are suitably designed and operating effectively. In a COSO-aligned internal control system, testing should be risk-based, clearly scoped, properly evidenced, and connected to the assessment of control deficiencies and remediation.
1. What control testing means
Control testing is the systematic evaluation of a control to determine whether it is designed appropriately and, when applicable, whether it operated effectively during the period under review. Testing should not be confused with simply confirming that a policy or procedure exists.
2. Start with the risk and control objective
Testing should begin with the objective and risk that the control is intended to address. Understand the objective, risk, control purpose, owner, frequency, population, expected evidence, and relevant changes before selecting test procedures.
3. Evaluate control design
Design effectiveness asks whether the control, if performed as described, is capable of addressing the relevant risk. Consider the link to the risk, point in the process, responsible person, frequency, information quality, exception handling, segregation of duties, and ability to retain evidence.
4. Evaluate operating effectiveness
Operating effectiveness considers whether the control actually operated as designed during the relevant period. Testing may consider frequency, appropriate performance, required review or approval, exception resolution, information reliability, and evidence supporting execution.
5. Define the testing objective and criteria
A good test procedure states what is being tested and what condition must be met for the control to be considered effective. Criteria should be established before evaluating results to support consistency and reduce the risk of changing the standard after seeing the evidence.
Related topics
Frequently asked questions
What is COSO control testing?
It is the systematic evaluation of a control to determine whether it is appropriately designed and, when applicable, operating effectively.
What is the difference between design and operating effectiveness?
Design effectiveness considers whether a control can address the relevant risk; operating effectiveness considers whether it actually operated as designed during the relevant period.
Does every testing exception mean there is a control deficiency?
No. An exception should be evaluated considering its nature, magnitude, likelihood, and other relevant circumstances.
Why is retesting important?
Retesting provides evidence that remediation addressed the underlying issue and that the corrected control is operating effectively.
From strategy to evidence
Set up your connected operating model. No sales delays or complex rollouts.