Control frameworks, key controls and control testing
Controls are the mechanism by which risk appetite is actually delivered. The exam tests control taxonomy, the difference between design and operating effectiveness, and how testing is scoped and evidenced.
Control types
- Preventive - stop it happening: access controls, mandatory fields, segregation of duties.
- Detective - find it after: reconciliations, exception reports, monitoring.
- Corrective - fix it: incident response, remediation.
- Manual vs automated - automated controls are more consistent but need change-control testing.
- Key controls are those that, if they fail, could cause a material loss or regulatory breach. Only key controls need full operating effectiveness testing.
Design vs operating effectiveness
Design effectiveness asks: if performed as described, would this control prevent or detect the risk? Operating effectiveness asks: is it actually performed, consistently, throughout the period? A four-eyes check that is well designed but performed by one person is failing on operating effectiveness, not on design.
Testing methods
Inquiry alone is the weakest evidence. Observation, walkthroughs, sample re-performance and data analytics are stronger. Sample sizes scale with frequency and risk; a daily control needs more samples than an annual one. The tester must be independent of the control owner - typically second line or internal audit.
Worked example
A daily reconciliation of client money is a key control. Testing 25 days finds two reconciliations signed off late and one with an unexplained break. Reasoning: design is effective (a daily reconciliation would detect the risk), but operating effectiveness fails - an 8% exception rate exceeds a typical zero-tolerance threshold for a key control. The control is rated ineffective, a control issue is raised, the linked risk's residual rating increases, and remediation with a deadline is assigned.
Traps that cost marks
- Testing design only and declaring the control effective.
- Relying on self-attestation by the control owner as assurance.
- Sampling only routine transactions and skipping exceptions, month-end and manual overrides.
- Failing to link failed controls back to the risk register and residual risk scores.