Documentation - Consider Risks/Controls

Consider inherent risks and evaluate their impact. For each step that you identified, consider the risks. What could go wrong during this step? Consider both unintentional errors as well as intentional fraud. The system workbook has a tab for each step. This tab provides a location to log in all potential risks.

Once you have identified the risk, you will need to evaluate it. Determine how likely the risk is to occur, on a scale of 1 to 10. Then determine (also on a scale of 1 to 10) how significant (or material) it would be to the Company if it did occur. The product of these two scores produces a risk score, where 100 represents the most critical risk and 1 represents the least critical risk. In general, the higher the risk score, the greater the testing coverage.

Determine if mitigating controls exist. Now that you have identified potential risks, determine if there are controls in place that will prevent this risk from occurring. Our Tool uses a risk based approach. Controls exist to mitigate a risk. If there is no risk, then there is no need for a control. In order to determine if controls are adequate, we first assess the risk and then we make sure we have controls in place to prevent all significant risks. Controls not determined to be sufficient to mitigate the risk, should be corrected prior to performing any testing.

Go on to Testing - Test Design and Testing >