Evaluating control performance requires assessing both the design and operating effectiveness of active controls. A control gap occurs when an existing control framework cannot mitigate an inherent risk to within acceptable thresholds.
Residual Gap Exposure = Inherent Risk Target Baseline - Confirmed Control Effectiveness
To evaluate control performance objectively, risk teams use structured testing methodologies:
- Inquiry: Interviewing control operators to confirm their understanding of the control’s purpose and performance steps.
- Observation: Visually monitoring the control operator as they execute the control during standard operations.
- Inspection: Reviewing documentation, log files, or approval records to confirm the control was performed correctly.
- Re-performance: Independently executing the control step to verify that the process yields identical, compliant results.
The testing team selects statistically valid sample sizes based on the frequency of the control (e.g., testing 25 samples for a daily control, or 50 samples for an automated transaction control) to confirm its operating reliability over time.
Â