Management Control Assessment and Test 

Use

When an organizational unit or process group has accepted a management control as relevant (see Accepting Management Controls), this management control must then be assessed by the org unit owner or process group owner. If the To Be Tested indicator is set, the effectiveness of the management control must also be tested. The test can be performed by any number of testers, provided that they have been assigned.

Prerequisites

In Customizing for MIC, the following is specified under Assessment and Test:

●     The ratings that require an assessor or tester to report an issue

●     The logic the system should use in aggregating the management control ratings at the superordinate level of the management control groups (applying the average of all ratings or applying the worst rating within the group)

●     The setting specifying whether the management control assessments need to be validated by another person

Those persons who are to perform the assessment or test have authorization for the relevant task (see Tasks: Management Control Assessment and Test).

Features

The range of functions for the assessment and test of management controls is essentially the same as for the Assessment of Control Design and Efficiency and for Testing Control Effectiveness. However, less data needs to be entered as the assessment and test result, that is, just one rating and, in cases where the rating is not green, a comment on the rating. Depending on the setting made in Customizing, an issue needs to be reported when a control receives a yellow or red rating.

Furthermore, note the following special features that apply to the assessment and test of management controls:

●     The user interface is not as complicated as that for assessing and testing controls. Since it is frequently the case that many management controls have to be edited by one person, all management controls are displayed in one list for editing. In this way, the assessment or test result for each management control can be entered quickly.

●     The rating for the assessment of a management control is always issued manually. It is not possible to determine the rating automatically.

●     The rating for the test result of a management control is also issued manually as opposed to being determined automatically from the number of issues.

●     There is no validation of management control tests.