Testing – Determine Sample Size and Design Test

Determine Sample Size
For each control, the system will determine the number of selections based on risk score and testing level. The risk score is calculated based on the significance score multiplied by the likelihood score. As the maximum score is 10 and the minimum score is 1, the risk score will vary from 1 (1 x1) to 100 (10 x 10). The risk score is then multiplied by the testing level to determine the required number of selections. The risk is plotted on a graph based on risk score, where it falls into one of four quadrants:

• Quadrant 1 – Significant and Likely (Material Weakness)
• Quadrant 2 – Significant but Unlikely (Significant Deficiency)
• Quadrant 3 – Likely but not Significant (Significant Deficiency)
• Quadrant 4 – Neither Likely nor Significant (Deficiency)

These quadrants will be used to evaluate any control weaknesses identified. For items falling into Quadrants 1 through 3, a minimum sample size of 25 is enforced.

Design Test
For each control, an area is provided for you to identify an appropriate test to verify that the control is functioning as designed.

Up to now, most of the compliance work you have done will not change significantly from year to year. However the testing and remediation work that you perform will be different every year. Prior to completing any test work, you should make a copy of all the files in the templates directory into the current year directory (ie FY 2005). All testing will be performed in the current year directory. As a result you will always have a clean set of customized templates ready to start testing for each new compliance year.

Go on to Testing - Select sample, Test controls and Track Results >