Rebuilding control testing at Ardent Financial Technologies, where four assurance teams tested the same 220 controls four different ways: the eight-step testing staircase from universe, design and populations through automation, evidence, deviations and reliance to assurance of the testing function; the change-approval test CTL-CHG-04 rewritten so it can fail, finding 9 failures in 75 tickets, a 12 percent rate against a 10 percent tolerable rate; and the external auditor moving from relying on none of 84 key-control tests to relying on 61, with 6,400 duplicated hours removed and re-performance cut from 410 hours to 6.

CY-EXPERT-043Expert Level · Cybersecurity Audit

Control Testing Architecture Assurance — The Testing Staircase

An expert-level course in designing the control-testing system itself so that tests are valid, populations complete, samples defensible, automation trustworthy, evidence re-performable, deviations evaluated correctly and results reusable across frameworks and auditors. Climb the Testing Staircase - eight steps from the test universe to assurance of the testing function - as Nadia rebuilds control testing at Ardent Financial Technologies, where four teams test the same 220 controls four different ways, a SOC 2 exception came from an incomplete population, an automated test passed for six months on a deprecated API, external auditors refuse to rely on internal work and 11,000 hours a year are duplicated. Grounded in PCAOB AS 2201 and AS 2315, the AICPA SOC 2 guide, ISACA ITAF, IIA GTAG on continuous auditing, COSO 2013, ISO 19011, PCI DSS 4.0 testing procedures, NIST SP 800-53A and ISO/IEC 27008.

18 hours8 chapters32 lessons225 activities8 labs

What you'll learn

Rationalise and govern a single test universe with key ratings, frequencies, risks and clause-level framework mappings, and design every test with explicit attributes, procedures, failure conditions and validated IPE.
Define and prove populations complete, derive sample sizes from recorded parameters and cited tables, and select samples by recorded unbiased methods that an auditor can regenerate.
Automate control tests as specified code with seeded cases, canaries and independent health monitoring, decide when continuous testing replaces sampling, and set evidence standards - capture, hashing, retention, indexing and single-source collection - that a stranger can re-perform.
Evaluate deviations with sampling risk, extension rules, root cause, aggregation and honest severity; earn reliance across frameworks and auditors through attribute unions, reliance criteria and aligned calendars; and assure the testing function with quality review, independent re-performance, metrics, cost and a governed architecture file.

Price:৳12,000