Sample size for remediated control 2563



  • If a test was tested to be ineffective during the interim testing, would you require the full sample size for the rollforward testing after the control is deemed to be remediated?



  • I would say it depends on the time difference between the interim testing and the re-testing after the remediation of the control weakness/deficiency and on the timing of the operation of the control.
    Is it a control that operates daily, weekly, quarterly? How many transactions are covered by the control at each operation? If the total population of transactions between the interim testing and the re-testing is very small, you will need a larger sample. The sample size only becomes irrelevant if the population is very large.
    If may also depend on your assessment of the design effectiveness of the new/remediated control and your gut feeling that they are willing to comply with the control now. In case of doubt, I would go for a larger sample to be on the safe side.



  • most of the big 4 auditors request( would say require) us to test double the normal sample size if one sample fails the control.
    Dunno how sane it is, but that is what they say



  • We require our teams to test a full sample when retesting a financial control that failed and is purported to be remediated. This also means that a remediated control has to operate for a period of time before it can be retested. This is really the only way you can ensure that it truly has been remediated and a change in process to address the prior failure has been worked into the normal routine.


Log in to reply