Control Testing Report

The Control testing report shows which controls work, which fail and which you have not tested lately. It reads the latest result for each control in your controls library. It is a state report: figures are as of today, and the as-of banner says so.

Headline Figures

• Controls tested, effective, and not effective.
• Controls tested with exceptions.
• Controls never tested.
• Controls not tested in the last 24 months.
• Controls that were effective at the test before but are not effective now.

In the Period

The tests performed in the period and the exception rate (exceptions found divided by items sampled).

Breakdowns

• Controls by family, by what was tested (design, operating effectiveness or both) and by test method.
• A matrix of the twenty controls most often found not effective against the subjects they were tested on.
• Every control with its last three results and any finding raised from it.

What "Never Tested" Counts

Never tested counts the controls on your audits and, unless you filter by audit type, lead auditor or plan year, the controls a privacy subject marks as implemented. Choose a security assessment type in the Audit type filter to see its control tests instead.

Filters and Drill-down

The filter bar offers audit type, lead auditor, plan year and audited subject. Every headline figure is a button that lists the controls behind it (Show all clears it). The report is hidden while the Audits board is off.

Related Pages

• Audit Details — recording control tests on an audit.
• Audit Findings — findings raised from a failed control.
• Audit Portfolio Report — the audit plan.