Control Effectiveness Testing overview

Tests the design and operating effectiveness of internal controls -- selecting control samples based on risk-tier prioritization, evaluating whether control design adequately addresses identified risks, testing operating effectiveness through walkthroughs, re-performance, and evidence inspection, assessing automated control configurations and access restrictions, identifying control deficiencies and classifying severity as gap, weakness, or material weakness, and tracking remediation commitments from prior testing cycles. Produces control testing results matrix, deficiency register, and remediation status report. Excludes control design and policy authoring.