Control testing is an evidence-based assessment of whether a control addresses its intended risk and operates as expected within the period reviewed.
A useful test file connects the risk, control, population, procedures, evidence and conclusion. It explains what was tested and what remains uncertain. Management owns the control; internal audit assesses it within the agreed engagement scope.
Distinguishing control design adequacy from operating effectiveness
The operation of internal control systems is the responsibility of the relevant line managers.
— National Treasury Internal Audit Framework2009, section1.3.2.5, page8
Evaluating an internal control framework requires distinguishing between design adequacy and operating effectiveness. Design adequacy assesses whether a control, if operated as intended, logically mitigates the targeted risk exposure.
Operating effectiveness evaluates whether a properly designed control actually functions consistently over a specified period in daily practice. A control may be present in policy documentation yet remain operating ineffectively due to inconsistent execution or supervisory lapses.
Internal audit delivers independent, objective evaluations of both dimensions, whereas management retains primary operational ownership for operating controls. Conflating design presence with operational effectiveness creates a false sense of control security.
Testing should examine evidence appropriate to the control, including reliable electronic records, observation, inspection or re-performance where relevant. This distinction separates control testing from initial framework design or post-audit remediation scoping.
Verifying population reliability and establishing risk-based selection rationales
Before executing control tests, auditors must verify the completeness and accuracy of the underlying population data. Testing incomplete or unverified populations compromises the validity of audit findings and conclusions.
Auditors obtain population data from general ledger extracts, system logs, or operational registers, performing reconciliation checks against source records. Assessing population reliability helps identify whether the selection has a defensible basis. A risk-selected sample is not automatically statistically representative of the entire population.
When selecting test items, auditors apply professional judgment to establish risk-based selection rationales rather than relying on arbitrary, universal sample sizes. Selection rationales reflect risk significance, transaction complexity, control frequency, and previous audit findings.
The scope may use selected items or a complete population where proportionate and feasible. Neither approach removes the need to establish data reliability, explain selection and recognise limitations. Risk-based selection focuses testing capacity on high-exposure areas where control breakdown would severely impact organisational objectives.
Executing structured test steps and gathering traceable evidence references
Control testing requires executing structured audit procedures that compare actual operational performance against established criteria. Standard testing methods include inquiry, observation, document inspection, and re-performance.
Inquiry alone provides insufficient evidence to support audit conclusions regarding operating effectiveness. Auditors combine inquiry with physical inspection of documentary evidence or direct re-performance of control activities to verify operational consistency.
Every test step must be documented in engagement workpapers, referencing specific source records, transaction identifiers, and verification dates. Maintaining traceable evidence references enables independent supervisors to reconstruct audit procedures and validate conclusions.
Workpapers must record the exact criteria applied, the population tested, the selection methodology, and observed results. Traceable documentation protects audit integrity and supports internal and external quality assessments.
Analysing control exceptions, acknowledging testing limits, and forming reviewer conclusions
When testing identifies deviations from established control criteria, auditors must analyse root causes rather than applying automatic pass or fail labels. A single exception may indicate isolated human error or point to systemic control breakdowns.
Auditors evaluate the nature, frequency, and risk impact of observed exceptions in collaboration with operational management. Differentiating isolated processing errors from structural control failures prevents misleading audit conclusions.
Control testing is subject to inherent operational limitations, including timing boundaries, sample coverage limits, and potential management override. Engagement communications must explicitly disclose these testing boundaries to prevent over-reliance on audit findings.
Reviewer conclusions synthesize test results to express an overall opinion on control adequacy and effectiveness. Chief audit executives review workpapers to ensure conclusions are supported by relevant, reliable, and sufficient evidence.
To ensure control-testing procedures remain rigorous and defensible, internal audit activities should embed several core practical routines:
- Reconcile population extracts against source ledgers before sample selection.
- Document explicit, qualitative risk-based selection rationales in workpapers.
- Combine inquiry with document inspection or re-performance to corroborate claims.
- Cross-reference test steps directly to evidence files and transaction records.
- Distinguish mandatory requirements ("must") from advisory guidance ("should" or "may").
Annotated four-column control testing matrix
The four-column matrix below illustrates a practical control-testing crosswalk, mapping qualitative hypothetical control scenarios against test steps, evidence references, and reviewer conclusions.
| Control Objective & Design | Test Procedure & Method | Evidence Reference & Population | Exception Analysis & Reviewer Conclusion |
|---|---|---|---|
| Ensure all procurement commitments above established thresholds receive dual authorisation prior to order placement. | Inspect approval signatures on purchase orders and re-perform system authorisation checks for selected commitments. | Reconciled procurement register; verified against approved purchase order files and system audit logs. | If selected commitments lack secondary sign-off, investigate the override and scope of the deviation. Do not conclude that design is adequate solely from the policy description. |
| Verify that monthly bank reconciliations are prepared timeously and reviewed by an independent supervisor. | Inspect monthly reconciliation statements, verify mathematical accuracy, and confirm supervisory review signatures. | Complete annual bank statement population; sample selected across all operating accounts. | All sampled reconciliations were signed by management, but calculation errors remained in selected items. Conclusion: Supervisory review was ineffective in detecting calculation errors. |
| Prevent unauthorised access to sensitive financial databases through quarterly access rights recertification. | Review quarterly access recertification logs and cross-reference active user lists against human resource termination records. | Active database user population reconciled against current payroll records. | Terminated staff retained active access rights for extended periods due to manual notification delays. Conclusion: Investigate notification, ownership and execution; absence of automation alone does not prove that a manual control is inadequately designed. |
| Safeguard physical inventory through monthly perpetual stock counts and independent variance reconciliations. | Observe physical stock count procedures and inspect inventory adjustment journals for supervisory sign-off. | Monthly inventory reconciliation sheets and perpetual stock ledger extracts. | Stock counts were conducted regularly, but variance adjustments were posted without required secondary authorisation. Conclusion: Operating effectiveness is impaired due to supervisory non-compliance. |
Sources
- National Treasury Internal Audit Framework, second edition March2009 — National Treasury
- IIA Global Internal Audit Standards2024, effective9January2025 — Institute of Internal Auditors
Frequently Asked Questions
Does the presence of a documented control policy guarantee operating effectiveness?
No, policy presence demonstrates control design intention but does not prove operating effectiveness. An operating-effectiveness conclusion needs suitable evidence of execution over the reviewed period, not merely the existence of a policy.
How do the 2024 Global Internal Audit Standards differentiate mandatory requirements from implementation guidance?
The 2024 Global Internal Audit Standards, effective January 2025, use "must" to specify mandatory, unconditional requirements. Non-mandatory implementation guidance offers advisory recommendations using "should" or "may".
How should the team choose between selected-item and full-population testing?
Choose a method that addresses the objective, risk, control frequency, population reliability and available evidence. Explain whether the selection supports any extrapolation. Full-population testing can be useful, but does not make unreliable data or an unsuitable procedure conclusive.
How do historical 2009 National Treasury guidelines view control testing compared to current global standards?
The 2009 National Treasury Framework provides historical local public sector context regarding internal audit's role in evaluating internal control under the PFMA. The 2024 Standards establish updated global mandatory requirements under Domain V for performing engagement testing.
What steps must auditors take when population data cannot be fully reconciled?
If population data cannot be reconciled against source records, its reliability is compromised. Evaluate the effect of unreliable data, seek additional or alternative evidence where feasible and record unresolved limitations. The final communication must explain relevant scope limitations; avoid implying that every data problem has the same prescribed response.
For wider context, read the internal control design and testing overview.