Design Effectiveness
Definition
The assessment of whether a control is designed in a way that would prevent or detect the risk it targets, if it operates as described. Typically tested through walkthroughs and documentation review rather than transaction sampling.
- Field
- Internal control / fraud examination
- Question asked
- Would the control work as designed, if operated properly
- Typical method
- Walkthroughs and documentation review
- Contrast
- Distinct from operating effectiveness (transaction sampling)
Common questions
Why test design effectiveness separately from operating effectiveness?+
A control can be well designed on paper but never actually performed, or performed inconsistently, so an examiner assesses whether the control logic could catch the risk before separately checking, through sample transactions, whether people actually carried it out as written.
What does a walkthrough involve in this context?+
An examiner traces one transaction through the process step by step, observing or interviewing the person who performs each control point, to confirm the control as documented would in fact prevent or detect the targeted error if it operated as described.
Related terms
- Audit Chain of Custody
- The documented record of when audit evidence was collected, by whom, from what source, and how it has been stored and accessed...
- Control Criterion
- The standard against which a control is evaluated. Criteria may come from an external standard (ISO 27001 Annex A, NIST CSF, PCI-DSS),...
- Evidence Sufficiency
- The standard that evidence must meet to support an audit conclusion. Evidence must be relevant to the control being tested, reliable in...
- Fieldwork
- The active evidence-gathering phase of an audit, during which the auditor applies testing procedures to specific controls and collects the evidence that...
- Operating Effectiveness
- The assessment of whether a control has consistently functioned as designed over the audit period. Requires evidence of actual operation, such as...