Control testing

A test of design asks whether a control can mitigate its risk if performed as described: the right objective, the right point in the process, an adequate frequency and a competent performer. A test of operating effectiveness asks whether it actually did so during the period under review, typically based on a sample and documented evidence. Both results are assessed and reported separately, because a well-designed control that is not performed is as ineffective as a poorly designed one.

FINMA Circular 2023/1 requires the effectiveness of key controls, those that mitigate material inherent risks, to be assessed regularly and documented by an independent control body, covering both design and operating effectiveness. Under FINMA Circular 2017/1, the audit committee monitors and assesses the effectiveness of the internal control system. For executives, aggregated test results are the factual basis for any statement about control effectiveness.

Pitfalls include control owners testing their own controls and calling it independent testing, tests without retained evidence, sample sizes without justification, and failed tests that do not lead to tracked remediation and a retest.

In practice

1. 01
   Plans tests every year based on risk, testing key controls more often and more deeply.
2. 02
   Separates tester and reviewer from the control owner and applies the four-eyes principle to test results.
3. 03
   Retains evidence of who tested what, when, with which sample and with what result.
4. 04
   Classifies deficiencies by severity and by origin in design or operation, and tracks remediation to a successful retest.
5. 05
   Reports effectiveness rates and trends by area rather than only lists of individual results.

Sources

• FINMA Circular 2023/1, Operational risks and resilience (banks), 7 December 2022 →
• FINMA Circular 2017/1, Corporate governance (banks), consolidated version, last amended 4 November 2020 →