Test control design and operating evidence

Continue the Acme case

The published matrix requires a relationship declaration before supplier selection. Acme's Aster purchase has valid order, receipt, invoice and payment evidence, but Tom's declaration was later. These facts can support a scoped control exception without changing the $6,000 transaction or claiming fraud.

Role and prerequisites

The Internal Control expert prepares the testing plan. Assigned testers perform scoped work; independent reviewers assess it. Owners provide evidence through their assigned Core work and cannot set their own effectiveness conclusion. Company, period, matrix revision and permitted source access must be established.

Test and follow up

1. Assess design against the criterion: does the procedure define timing, independent review, evidence and exception handling? Record limitations rather than replacing missing steps with an optimistic rating.
2. Build a test plan with explicit control selection, exclusions, assignments and required approval. Define the population, source date and completeness. In this small exercise, the tested item is Acme's single Aster selection; do not generalise one item to all company procurement.
3. Inspect its exact documents and dates. Record that order/payment checks were evidenced while the relationship declaration was late. Preserve the distinction between design and operating results.
4. Submit the supported test conclusion for independent review. Retain any return, corrected evidence and reviewed revision. Record the approved issue and corrective owner where required.
5. Obtain implementation evidence for the improved declaration checkpoint. An independent follow-up tests its operation on eligible subsequent evidence; a new policy or owner reply alone cannot close the failure.

Verify the saved result

The reviewed test retains its population, sample rationale, source versions, exception and follow-up status. The original failure remains in history after remediation. If no later transaction is available, follow-up is pending rather than effective by assumption.

Continue to independent audit. A test result is scoped evidence, not a certification of every company control.