Sample size for remediated control 2563
-
If a test was tested to be ineffective during the interim testing, would you require the full sample size for the rollforward testing after the control is deemed to be remediated?
-
I would say it depends on the time difference between the interim testing and the re-testing after the remediation of the control weakness/deficiency and on the timing of the operation of the control.
Is it a control that operates daily, weekly, quarterly? How many transactions are covered by the control at each operation? If the total population of transactions between the interim testing and the re-testing is very small, you will need a larger sample. The sample size only becomes irrelevant if the population is very large.
If may also depend on your assessment of the design effectiveness of the new/remediated control and your gut feeling that they are willing to comply with the control now. In case of doubt, I would go for a larger sample to be on the safe side.
-
most of the big 4 auditors request( would say require) us to test double the normal sample size if one sample fails the control.
Dunno how sane it is, but that is what they say
-
We require our teams to test a full sample when retesting a financial control that failed and is purported to be remediated. This also means that a remediated control has to operate for a period of time before it can be retested. This is really the only way you can ensure that it truly has been remediated and a change in process to address the prior failure has been worked into the normal routine.