Control Testing

Control testing is the process auditors use to determine whether security controls are properly designed (design effectiveness) and consistently operating as intended (operating effectiveness). It is the core activity in any compliance audit — the mechanism by which claims about security are verified with evidence.

Design vs. Operating Effectiveness

• Design effectiveness — Is the control designed in a way that, if it operates as intended, would achieve the control objective? A SOC 2 Type I audit tests only design effectiveness.
• Operating effectiveness — Has the control actually been operating as designed throughout the audit period? A SOC 2 Type II audit tests both design and operating effectiveness over a period of time.

Testing Methods

Auditors use several methods to test controls:

• Inquiry — Asking personnel how a control works. Typically supplemented by other methods.
• Observation — Watching a control being performed in real time.
• Inspection — Examining documentation, configurations, logs, and records as evidence that a control operated.
• Reperformance — The auditor independently performs the control activity to verify the result.

For SOC 2 Type II audits, auditors typically sample control instances across the audit period. For a control that operates daily, they may sample 25-30 instances across the period. For quarterly controls, they expect to see all four instances.

What Happens When Controls Fail

When testing reveals that a control did not operate effectively, the auditor documents an exception. Exceptions appear in the SOC 2 report and may affect the auditor's opinion. Isolated exceptions with compensating controls may not affect the overall opinion, while pervasive exceptions can result in a qualified or adverse opinion.

For ISO 27001, failed controls result in nonconformities that must be addressed through corrective action before certification can be granted or maintained.

Preparing for Control Testing

Ensure consistency. Controls must operate consistently throughout the audit period, not just when auditors are watching. A control that works 80% of the time will generate exceptions.

Maintain evidence. Every control instance should generate evidence. If a control requires quarterly access reviews, each review should produce dated documentation showing who reviewed, what was found, and what actions were taken.

Test internally first. Conduct internal control testing before the external audit to identify and remediate weaknesses proactively.