QULDEXResources · Template
Control test script template: fields and worked example
What is a control test script?
A test script turns 'check access management' into a procedure another auditor could repeat and get the same answer. It fixes the population, the sample and the steps before the tester sees the records.
The completed script is a working paper. With its evidence attached, it supports the finding, or the absence of one, in the audit report.
Objective, method, population, sample and expected result.
Follow the steps for each sampled item and keep the evidence.
Record the result and exceptions; a reviewer checks the conclusion.
Control test script template
Fifteen fields. The example tests removal of leavers' access.
| Field | Example | What to write |
|---|---|---|
| Test reference | T-018 | A unique number, linked to the audit |
| Control | Accounts are disabled on the leaver's last working day (A.5.18) | The control statement and its reference |
| Objective | Confirm the control operated throughout the period | Design, operating effectiveness, or both |
| Method | Inspection of records | Inquiry, observation, inspection or re-performance |
| Population and source | All leavers 1 Apr to 30 Sep 2026, from the HR system: 84 | And how completeness was confirmed |
| Sample | 25, selected at random | Size and how chosen |
| Step 1 | Obtain each leaver's last working day from HR | Number each step |
| Step 2 | Obtain the time each account was disabled, from system logs | |
| Step 3 | Compare; an account active after the last working day is an exception | |
| Expected result | All accounts disabled on or before the last working day | What passing looks like |
| Evidence kept | HR report; log export; comparison sheet | What is retained |
| Actual result | 22 on time; 3 disabled 2 to 9 days late | What was found |
| Exceptions | 3, listed with dates | Each item that failed |
| Conclusion | Not operating effectively; finding F-01 raised | Effective or not, and the finding reference |
| Tester and reviewer | Auditor, 13 Oct 2026; lead auditor, 14 Oct 2026 | Names and dates |
The example values are illustrative. Copying pastes the table as rows and columns into a spreadsheet or document.
How do you fill it in?
- Start from the control statement
Test what the control says, not what you assume.
- Confirm the population is complete
Before you sample from it.
- Fix the sample and the steps in advance
So the result does not depend on the tester.
- Keep the evidence for every sampled item
Including the ones that passed.
- Have the conclusion reviewed
By someone who did not perform the test.
What goes wrong most often?
No expected result
The tester decides afterwards what counts as a pass.
Instead: define it before testing.
Sample picked by the auditee
The examples shown are the good ones.
Instead: select from the full population yourself.
Evidence not retained
The conclusion cannot be re-checked.
Instead: attach evidence for each item.
Do you need a template at all?
Plan, test, record findings and report in eight phases, with every step recorded against the audit.
Control test script template: common questions
What is the difference between a test script and a test plan?
A plan sets out which controls will be tested in an audit. A script is the procedure for testing one of them.
How many items should be sampled?
It depends on how often the control runs and the risk. Record the population, the sample size and how items were selected.
What counts as an exception?
Any sampled item where the control did not operate as designed. The auditor then judges whether the exceptions mean the control failed.
Is this template free?
Yes. It is on this page, with no form to fill in.
Write the test, record the result, raise the finding
The record lives with the audit, linked to its controls, findings and report.