PC 2.5 - Test of Effectiveness Vs. Control Monitoring

[yudittzruya]

Hi All,

can you elaborate on the deference between the tow - from a business view and a technical view.

Thanks

[Former Member]

Yudit:

The only thing I'd like to clarify from the 2nd post is that the manual test of effectiveness is performed by Internal Audit and not the Control Owner. The task PERF-TEST is in the process level role "Tester". The "Tester" role is assigned to the person performing the tests, which is usually Internal Audit.

Matt

[Former Member]

Test of Effectiveness: This is to test the manual controls. We will be able to perform this for a manual control only if a test plan is assigned to it. We will have test steps under a test plan and when u perform test of effectiveness, the control owner gets this assessment and he needs to mention whether the test steps are done or not and he can give an overall rating for the test. If he gives the rating as Deficient or Significnatly Deficient, an issue is generated and sent for a review.

Control Monitoring: Control monitoring can be done only if a rule is assigned to an automated control. In the rule we mention, what exactly should be done in the monitoring process. For example: In rule we can mention that the data related to Company code XYZ should be filtered and displayed. It displays the data corresponding to that company and we can monitor the data. Another example is if you want to capture if there is any change to a particular data attribute, you can also do that.

[yudittzruya]

Thanks for the detailed review.

so, just to be sure, from the business point of view the purpose of them both is the same. the only deference is that Test of Effectiveness is being done manually for manual controls and Control Monitoring is being done automatically for automated controls ?

what is the case with semi-automated controls ?

thanks

[Former Member]

Automated controls are for continuous monitoring of data. You can schedule them to run with certain frequency where as you cannot do the same for manual controls. Manual controls should be scheduled manually.

An issue is generated automatically by an automated control if there is some exception in data. In manual control, an issue is generated manually by the user.

Semiautomated controls are very similar to automated controls but differ in certain workflow tasks.

And one more important thing to note is that you can perform test of effectiveness for automated controls also. If you perform test of effectiveness for automated controls, jobs are created for each rule assigned to that control and issues are generated accordingly.