Testing As with other control functions within an organization, independent testing should be conducted to verify that compliance-risk mitigation activities, including training and internal controls, are in place and functioning as intended throughout the organization. Whereas monitoring is an ongoing process, testing is a "point-in-time" event, a critical check of performance.
The frequency of testing should be based on risk--on such factors as whether significant deficiencies were identified through a recent examination or during the last testing; whether the business line's products or activities have grown or changed significantly; or whether a high risk that may directly affect the organization's activities has been identified.