Test of Control Effectiveness 

Use

For compliance with the Sarbanes-Oxley Act, it is mandatory to test the effectiveness of at least the most significant controls. In contrast to the assessments, the effectiveness test takes place at a later stage in the project after the assessments have been closed and the improvements to the processes and controls have been implemented.

The test can be performed manually by the highest management level or by internal or external auditors. In addition, you can perform an automated or semi-automated test on controls in a third-party system and transfer the test results to MIC. With a semi-automated test, a tester in MIC reviews the test result taken from the third-party system and sends the test result manually. With an automated test, no tester is required in MIC.

Whether a control must be tested and how the test is to occur is specified in the control attributes.

Prerequisites

You defined the possible values for the Testing Technique attribute in Customizing. Choose Edit Attribute Values.

Features

A test is triggered by scheduling the Test Control Effectiveness task.

Tester Assignment

You can assign testers separately for each individual control or collectively for all controls in a process group or an organizational unit.

●     Individual Assignment

When you schedule the Test Control Effectiveness task, the Trigger Tester Assignment pushbutton is available. When you choose this pushbutton, the system sends the Assign Tester (ASGN-TSTER) task to the person responsible for the relevant task.

●     Mass Assignment

For more information, see Mass Assignment of Testers.

 

Note that testers are assigned in relation to a timeframe, not based on the point in time. This is significant when you call one of the Web applications for assigning testers from within the navigation area. In this case, the personalized timeframe must agree exactly with the timeframe for which the task for performing the test is scheduled.

For example, if you want the test to be performed once each quarter, the testers must also be assigned for each quarter individually. It is not sufficient to assign testers for the entire year.

You can assign multiple testers to the same control, since a test for a timeframe can be performed by a number of testers in parallel. To specify that it is sufficient for only one of these assigned testers to perform the test, you set the One Test Sufficient indicator. If this indicator is set and one tester has closed the test, then the system deletes the task for all of the other testers.

The One Test Sufficient indicator applies only to manual tests. If you want to perform automated or semi-automated tests on a control and you also assign manual testers, then it is mandatory to also perform a manual test ‑ even if the One Test Sufficient indicator is set and the automated or semi-automated test is closed.

If you create persons during the assignment of testers, then the persons must also be connected to users (see Creating Users and Connecting Users to Persons).

Performing Manual Tests

At the scheduled point in time, the system sends the task for performing the manual test to the testers that were assigned. When a tester calls up the task, all necessary information appears under Test (such as the information concerning the testing technique).

Since several testers can test the effectiveness of the same control for the same timeframe, their separate test results are written to test logs. A test log can only be modified when it has Draft status. Once the tester has submitted the log, no more changes can be made.

The tester enters the following details in the test log:

●     A comment text describing the test result (only possible in the form view)

●     Test date

●     Information about whether the tester applied the testing technique specified in the control attributes (standard testing method) or a different testing technique (Own Testing Method).

If the tester finds that the effectiveness differs from that expected (thereby producing a negative test result), he must report this by creating an issue. Once the tester has submitted the test log, the system sends the reported issue to the specified processor for remediation.

The rating for the effectiveness of a control within a timeframe is issued automatically for the entire control and not for every individual test log. Ratings are issued as follows:

●     Green: No issues to be resolved

●     Yellow: Issues exist with priority 2 to 3.

●     Red: At least one issue exists with priority 1.

In Customizing, you can specify that the test results have to be validated by the owner of the superordinate object.

See also:

Process Flow of Assessments and Manual Tests

Performing Automated Tests in Third-Party Systems