Control testing (design and operating effectiveness)

Roles that need it

• Internal Auditor
• IT Auditor
• External Audit Associate
• Operational Risk Analyst
• Internal Audit Consultant

Skills it belongs to

• Audit methodology
• Internal controls and risk oversight
• Attention to detail

Related concepts

• Key controlA key control is a control that on its own, or with a few others, prevents or detects a material error or a significant risk. Key controls are documented with an owner, frequency and evidence, and are tested more often than other controls.
• SOX controls (ICFR)SOX controls are the internal controls over financial reporting (ICFR) that US-listed companies must document, test and report on under the Sarbanes-Oxley Act, sections 302 and 404. Management assesses them each year and, for larger filers, the external auditor gives an opinion on their effectiveness.
• RCSA (risk and control self-assessment)A risk and control self-assessment is the periodic exercise in which a business unit identifies its operational risks, rates inherent risk, assesses how well its controls work and derives the residual risk. Results are challenged by the second line and lead to actions where residual risk exceeds appetite.
• Internal auditInternal audit is the independent function that gives the board assurance on governance, risk management and internal controls. In the three lines model it is the third line, reporting to the audit committee. Banking rules require it to be independent of the activities it audits.

Sources

• AS 2201 An Audit of Internal Control Over Financial Reporting, PCAOB (external site) accessed 31 Oct 2026

Updated 31 Oct 2026.