Testing, Evidence, and Quality Assurance over RCSA Outputs
Core concepts
Testing validates that controls operate as described. Candidates must know the distinction between design effectiveness and operating effectiveness, and between tests of one (a single instance) and tests of many (a sample). Sampling requires a defined population, a documented selection method (random, systematic, haphazard, judgmental), sample size tied to frequency and risk, and clear pass/fail criteria. Evidence must be sufficient, reliable, and relevant - original documents, system reports, and logs are stronger than verbal confirmation or self-attestation.
Quality assurance over RCSA outputs includes second-line challenge of risk statements and scores, completeness and consistency checks, recalculation of ratings, review of control mapping, and periodic independent review. Findings should be tracked with owners and due dates. Evidence retention must meet policy and regulatory requirements.
Traps
Common traps: accepting self-attestation as testing evidence; sampling without a defined population; testing one instance and concluding operating effectiveness for a high-frequency control; and treating a passed test as proof of design adequacy. Another trap is QA performed by the same person who performed the assessment without independence.
Worked example / rule of thumb
Rule of thumb: "No population, no sample; no evidence, no conclusion." Example: a daily reconciliation control requires a sample of at least several days across the period, drawn from a documented population of daily reconciliations, with evidence of reviewer sign-off and exception follow-up. A single signed reconciliation supports one instance, not a conclusion about the control's operation across the year. If an answer accepts a single instance for a daily control, it is likely wrong.