QULDEXResources · Glossary
What is control testing? Methods, steps and examples
What does control testing involve?
Testing answers two separate questions. Design: if this control were carried out as written, would it deal with the risk? Operation: was it actually carried out, every time it should have been?
A control can be well designed and still fail in operation, for example an access review that is specified quarterly but was done only twice in the year.
What are the methods of control testing?
Asking people how the control works, and watching it being done.
Examining records such as tickets, logs, approvals and exports.
The auditor carries out the control independently and compares the result.
What does a control test look like?
Testing the control 'accounts are disabled on a leaver's last working day'.
| Item | What it looks like |
|---|---|
| Population | All 84 leavers between 1 Apr and 30 Sep 2026, from the HR report |
| Sample | 25 leavers selected at random |
| Procedure | For each, compare the last working day with the time the account was disabled |
| Result | 22 on time, 3 late: three exceptions |
| Conclusion | Control not operating effectively; finding raised |
This is an illustration written for this page, not a customer record.
What do frameworks say about testing controls?
| Framework | Where | What it asks for |
|---|---|---|
| ISO 27001 | Clause 9.1 | The organisation evaluates information security performance and the effectiveness of the management system. |
| ISO 27001 | Annex A 5.35 | The approach to information security and its implementation is independently reviewed at planned intervals. |
| SOC 2 | Type 2 report | The auditor tests the operating effectiveness of controls over the period and reports the tests and results. |
| NIST 800-53 | SP 800-53A | Assessment procedures use three methods: examine, interview and test. |
References are to the current editions listed under Sources. Check the edition your auditor is using.
What weakens a control test?
Sample chosen by the auditee
The team picks the examples it wants to show.
Instead: the auditor selects the sample from the full population.
Population not confirmed
The list sampled from is incomplete.
Instead: check the population is complete before sampling.
Inquiry alone
The auditor relies on what people say.
Instead: support interviews with records.
How does QULDEX handle this?
Plan, test, record findings and report in eight phases, with every step recorded against the audit.
Control Testing: common questions
What is the difference between a test of design and a test of operating effectiveness?
A test of design asks whether the control, as written, would address the risk. A test of operating effectiveness asks whether it was actually performed as written over the period.
How large should a test sample be?
It depends on how often the control runs, the risk, and the confidence needed. Document the population, the sample size and how items were chosen.
What is an exception?
A sampled item where the control did not operate as designed. The auditor evaluates exceptions to decide whether the control failed.
Sources
- ISO 19011:2018, Guidelines for auditing management systems
- NIST SP 800-53A Rev. 5, Assessing Security and Privacy Controls
- ISO/IEC 27001:2022, Information security management systems: Requirements
- AICPA, 2017 Trust Services Criteria (with revised points of focus, 2022). aicpa-cima.com
Test, record the result and raise the finding in one place
Controls, evidence, findings and corrective actions in one audit workspace.