Automated Control Testing Techniques

Automated Control Testing

Types of Automated Controls

IT General Controls (ITGCs)

• Access Security: User provisioning, authentication, authorization
• Change Management: Development, testing, approval, migration
• Computer Operations: Job scheduling, backup/recovery, incident management
• Program Development: SDLC controls, testing, approval

Application Controls

• Input Controls: Validation, authorization, completeness
• Processing Controls: Calculations, data matching, exception handling
• Output Controls: Report generation, distribution, reconciliation

Configurable Controls

• System settings that enforce business rules
• Tolerance limits
• Workflow approvals
• Segregation of duties

Testing IT General Controls

Access Security Testing

Design tests:

• Review access request process
• Evaluate role-based access design
• Assess password policy

Operating tests:

• Sample access provisioning
• Periodic access reviews
• Privileged account monitoring
• Terminated user access removal

Change Management Testing

Design tests:

• SDLC documentation
• Approval requirements
• Segregation of duties

Operating tests:

• Sample change tickets
• Test vs. production separation
• Emergency change procedures
• Post-implementation review

Testing Application Controls

Configuration Testing

• Obtain system settings
• Compare to design specification
• Test override capabilities
• Evidence of periodic review

Interface Testing

• Data completeness
• Transformation accuracy
• Error handling
• Reconciliation controls

Calculation Testing

• Re-perform calculations
• Test boundary conditions
• Verify formulas
• Exception testing

Continuous Control Monitoring

Approach

• Real-time or near real-time testing
• 100% population vs. sampling
• Exception-based alerting
• Automated remediation workflows

Use Cases

• Access monitoring
• Transaction testing
• Configuration verification
• Segregation of duties

Implementation

1. Define monitoring rules
2. Connect to data sources
3. Set thresholds
4. Configure alerts
5. Establish response procedures

Documentation for Automated Controls

• System screenshots
• Configuration exports
• Test scripts and results
• Population and sample selection
• Exception investigation