Test of controls

A test of controls is an audit procedure used to determine whether a specific control is operating effectively as designed. It evaluates if the process consistently prevents or detects errors, omissions, or unauthorized actions over a defined period. The objective is to confirm that the internal control environment can be relied upon to mitigate identified risks.

In practice

An auditor might review a sample of new employee access requests to verify that each one was formally approved by a manager before permissions were granted. This confirms that the "Access Approval" policy is functioning in reality rather than existing only as written documentation.