Home › Cybersecurity & GRC Career Guides › Controls Testing Skills

Controls Testing Skills

Get new GRC career guides by email. We publish most weeks. No spam, and we never sell or share your address with anyone.

Testing a control means answering one question with evidence: did this thing actually happen, every time it was supposed to, for the whole period? Most people who say they can test controls can really only inspect a document, which is a different and much weaker activity.

Design versus operating effectiveness

These are two separate tests and conflating them is the most common beginner error.

Design effectiveness asks whether the control, if performed as described, would actually address the risk. A quarterly access review that covers only three of eleven production systems is badly designed, and no amount of diligent execution will fix that.

Operating effectiveness asks whether it was performed, on time, throughout the period. A well designed control that ran in January and then stopped fails here.

Test design first. Testing whether a broken control was performed reliably is wasted effort.

The four methods, in ascending order of strength

Inquiry is asking someone. It is the weakest, and on its own it is not evidence of anything. Observation is watching it happen, which proves it can happen but not that it usually does. Inspection is examining the records the control left behind, and it is the workhorse of the discipline. Reperformance is doing the control yourself and comparing results, which is the strongest and the most work.

Real testing usually combines them: ask how it works, then inspect the records, then reperform a couple to check the records are telling the truth.

Sampling, and the part people get wrong

The number is not the hard part. Common guidance for a control performed daily is a sample of twenty five to forty, for weekly around five to fifteen, for monthly two to five, and for quarterly or annual controls you test all of them.

The hard part is the population. A sample is only meaningful if it was drawn from a complete list of every time the control should have run. If the population came from a report the control owner produced, and that report silently excludes a system, your sample can be perfect and your conclusion still wrong. Establishing completeness of the population is the skill; picking items from it is arithmetic.

Random selection matters for the same reason. If the owner picks the items, you are testing the ones that worked.

Exceptions

An exception is any instance where the control did not operate as described. One exception in a sample is not automatically a control failure, but it is never nothing, and the reflex to explain it away is the habit that ruins testers.

The questions that matter are what caused it, whether it is isolated or systemic, and whether the same cause could have produced exceptions you did not sample. That analysis, written plainly, is what a reviewer is really assessing when they read your workpaper.

Workpapers that survive review

Someone who was not there must be able to read your file and reach the same conclusion. That means recording what you tested, the period, how the population was established and why you believe it is complete, how items were selected, what you found including the exceptions, and the conclusion that follows.

The discipline of writing it that way is much of what separates an experienced tester from a competent one, and it is exactly what an interviewer is probing when they ask you to walk through a test you performed.

Where to go next

Frequently Asked Questions

What are controls testing skills?

The ability to determine whether a control is properly designed and whether it operated throughout a period, using evidence rather than assurance. It covers test planning, establishing a complete population, sampling, evaluating exceptions, and documenting the work so a reviewer can follow it.

What is the difference between design and operating effectiveness?

Design effectiveness asks whether the control would address the risk if performed as described. Operating effectiveness asks whether it was actually performed, on time, for the whole period. Design is tested first, since testing execution of a badly designed control tells you nothing useful.

What are the four control testing methods?

Inquiry, observation, inspection and reperformance, in ascending order of strength. Inquiry alone is not evidence. Reperformance is strongest and most laborious. Most real testing combines inquiry to understand the control, inspection of its records, and reperformance of a small number to verify the records.

How do you determine sample size?

Common guidance is twenty five to forty items for a daily control, five to fifteen for weekly, two to five for monthly, and complete testing for quarterly or annual controls. The number is the easy part. The difficult part is proving the population you sampled from is complete.

Why does population completeness matter?

Because a sample drawn from an incomplete population produces a confident and wrong conclusion. If the list of control occurrences came from a report the control owner generated, and that report omits a system, your testing can be flawless and still miss the failure.

What happens when you find an exception?

You determine the cause, whether it is isolated or systemic, and whether the same cause could have produced exceptions outside your sample. A single exception is not automatically a control failure, but explaining it away without that analysis is the habit that undermines a tester's credibility.

What makes a good workpaper?

Someone who was not present should be able to read it and reach the same conclusion. Record what was tested, the period, how the population was established and why it is complete, how items were selected, what was found including exceptions, and the conclusion that follows from it.

Do I need to be an auditor to test controls?

No. Controls testing is performed by internal audit, compliance, security assurance and GRC teams, and increasingly by engineers running continuous control monitoring. Audit training makes the discipline explicit, which is why audit experience transfers so readily into GRC.

What jobs require controls testing skills?

Internal auditor, IT auditor, GRC analyst, compliance analyst, SOX analyst, security compliance manager, and AI governance roles testing model controls under ISO/IEC 42001 or the NIST AI RMF.