Testing cadence

Whether each control was tested within its stated frequency plus a tolerance, from the control register joined to the testing log. Adherence per owner and unit; the slipped list ranked by the control's risk rating.

DefinitionWhether each control was tested within its stated frequency plus a tolerance, from the control register joined to the testing log. Adherence per owner and unit; the slipped list ranked by the control's risk rating.

Three states

Every control is on cadence, slipped or never tested. The assertion is that the three sum to the register.

Risk beside the percentage

Ninety-three percent adherence hides one high-risk control nobody has tested. Show the high-risk slipped count next to it.

How it is computed

Controls tested within their stated frequency plus a tolerance, divided by controls due, by risk rating.

Example

Of 210 controls due this quarter, 176 were tested on time. Of the 34 that slipped, nine are rated high.

Where it goes wrong

Reported as one percentage. The nine high-risk controls are the finding.

Articles that use this term

Board and management reporting · Compliance

Issue ageing by owner: open findings past their remediation date

How a compliance or internal audit team reports the findings that are open past their agreed remediation date, from the issue register: ageing bands per owner and business unit, the extensions granted and how many times, the high-rated issues past date, and the trend that shows a remediation programme slipping before the board asks why the same finding is on the pack for the third quarter.

16 Sept 20263 min read Coverage and territory · Compliance

Obligation-to-control coverage, asserted: the compliance roll-up

How a compliance function measures control coverage from the obligations register, the control library and the testing log: obligations with no mapped control, controls past their test date, entities outside their review cycle, and the reconciliation that lets the board pack and the regulator see one number.

16 Sept 20263 min read Coverage and territory · Compliance

Ten questions a head of compliance asks, and the table that answers each

The ten questions a head of compliance puts to the business units and the compliance team, which obligations have no control, which controls were not tested on schedule, which findings are past their date and how many times extended, which regulatory changes have no mapping yet, who is overdue on training, which units report nothing, which high-rated issues are open, what will a regulator find first, what did the last audit find that the register did not, and what changed, each with the table from the registers, the identity behind it, and the answer to send back.

16 Sept 20262 min read Board and management reporting · Compliance

Testing cadence: controls tested on schedule, and the ones that slipped

How a compliance team measures whether each control was tested when its plan said it would be, from the control register and the testing log: cadence adherence per control owner and business unit, the slipped-test list ranked by the risk the control covers, and the trend that shows a testing programme quietly falling behind before the regulator asks.

16 Sept 20262 min read Data quality and reconciliation

The identity by industry: what has to sum to what on twelve desks

Every report on this site rests on an identity, a sum that must hold before any measure is read, and the sum is different on every desk: revenue to the ledger, TEU to booked TEU, seats to contracted seats, controls to the register, rental days to invoiced revenue. This hub gives, for twelve industries, the identity, the exports it joins, the failure it most often catches, and the guide where it is used.

16 Sept 20263 min read Coverage and territory · Compliance

Training completion against role requirement: who is overdue, by unit

How a compliance team measures mandatory training coverage from the learning system export and the HR roster: each person's required modules from their role, completions and expiry dates, the share complete per business unit and per module, the people overdue with the days, the new joiners past their onboarding window, and the identity that every required assignment is complete, overdue or not yet due.

16 Sept 20262 min read