Testing and Remediation

When you reach the testing stage of your ICFR process, you are looking to determine if your controls are working as documented, and if they are adequate to ensure compliance.  This phase can be very time-consuming, especially if done improperly.

Testing controls that may pose a high risk of failure is a must under NI 52-109's legislation.  Performing testing and the subsequent remediation also helps assisting in locating weaknesses in your current processes and financial reporting.

What you Need to in this Phase

1. Use proper automated tools to record your testing on various controls and allow adequate reporting.
2. Ensure you document your risk areas and corresponding controls, test plan, testing methodology and conclusions in a repository to assist in the Certification process now and in ongoing years.
3. Determining scope and breadth controls test is important to the success of your overall project.  It is facilitated with your proper planning, scoping and documentation at preceding stages.  High risk processes should always be tested. 
4. Performing tests of controls to uncover design and operational flaws is essential.
5. High risk controls require extensive testing to provide reasonable assurance that misstatements can be prevented or detected.
6. Walkthroughs, observation, inquiry, documentation inspection and re-performance tests are some of the testing methods that can be used.
7. Where controls fail a test, a remediation is required in order to correct the problems and work to prevent and potential material misstatements.  

1. Many companies used a 100% approach in performing testing, performing documentation and testing with the same level of detail for all types of controls.  This is a waste of time and money.
2. Heavy emphasis on strong Entity-Level Controls is essential to holding time and cost down on your project
3. A risk assessment to properly scope your project and understand the risk with significant accounts helps determine the chance of material misstatements arising and assists in the later determination of appropriate controls to test.
4. Certain low risk controls that are associated with a strong control environment will not need to be tested. Testing is a time consuming process, especially if controls fail the tests and remediation and re-testing must occur.
5. Do not underestimate the time that is necessary, as many companies have.