This page defines the standard method for testing controls within AuditFlow OS.

It helps users assess whether controls are appropriately designed, operating effectively, and supported by sufficient evidence.

This method should be used across cyber, AI, data, governance, third-party, and IS4-style reviews.

Purpose

The purpose of this method is to:

• define how controls are selected and tested
• establish a standard approach to design and operating effectiveness review
• ensure findings are supported by reliable evidence
• improve consistency across audit types
• support defensible assurance ratings and risk conclusions

This method applies to audits and control reviews performed within AuditFlow OS.

Testing Principles

All control testing should follow these principles.

1. Risk-based

Testing should focus on the controls that matter most to the audit objective and risk position, not only the controls that are easiest to inspect.

2. Evidence-based

Testing conclusions should be supported by documented evidence. Assertions without evidence should not be treated as proof of control effectiveness.