Sample size for remediated control 2563
Hoiya last edited by
If a test was tested to be ineffective during the interim testing, would you require the full sample size for the rollforward testing after the control is deemed to be remediated?
gmerkl last edited by
I would say it depends on the time difference between the interim testing and the re-testing after the remediation of the control weakness/deficiency and on the timing of the operation of the control.
Is it a control that operates daily, weekly, quarterly? How many transactions are covered by the control at each operation? If the total population of transactions between the interim testing and the re-testing is very small, you will need a larger sample. The sample size only becomes irrelevant if the population is very large.
If may also depend on your assessment of the design effectiveness of the new/remediated control and your gut feeling that they are willing to comply with the control now. In case of doubt, I would go for a larger sample to be on the safe side.
NC last edited by
most of the big 4 auditors request( would say require) us to test double the normal sample size if one sample fails the control.
Dunno how sane it is, but that is what they say
kymike last edited by
We require our teams to test a full sample when retesting a financial control that failed and is purported to be remediated. This also means that a remediated control has to operate for a period of time before it can be retested. This is really the only way you can ensure that it truly has been remediated and a change in process to address the prior failure has been worked into the normal routine.