An internal control test means doing what the auditor will do, on a small scale, a few weeks early. Pick a sample for each key control, check the evidence, note what fails and fix it. It turns surprises into a to do list.
Why test yourself
Auditors find the same kinds of gaps in many programs: missing approvals, late removals, evidence that cannot be found. Finding them yourself costs less and leaves time to fix the process, not just the paperwork.
Set it up
- Choose the controls. Start with those that run often and have people involved.
- Get the population for each from the source system.
- Pick a sample. Use a method you can explain, such as random selection from the list, and record how you picked.
- For each item, write what a pass looks like.
- Assign the test to someone who does not run the control. Independence makes it a real check.
Do the test
For each sampled item, look for the evidence and decide pass, fail or unclear. Write down the reason and file a copy of the evidence. Do not fix the item while testing, or you lose the finding. Fix after you record it.
If many items fail the same way, the cause is likely the process, not individual mistakes. Note that pattern.
Look at the population too
Check that the list is complete. Compare it with a second source: HR against identity, deployments against merged pull requests. A missing item here is a bigger issue than a failed item in the sample.
Triage and fix
Sort findings into three groups:
- Evidence exists but is hard to find: fix the filing.
- Control ran but evidence is missing: fix collection.
- Control did not run: fix the process, and consider whether to tell the auditor.
Retest the fixed items later, to show they stay fixed.
Keep the results
Store the test plan, samples and results. They show the auditor that you monitor your own controls, which is a control in itself. Be honest in the notes. A test that finds nothing is worth less than one that finds something and fixes it.
Test each key control at least once a period, more often for high risk ones. Safeguard's compliance and evidence automation can run recurring checks and keep the results, which covers part of this; human sampling still catches judgment problems.
Report the results to leadership in plain terms: how many controls tested, how many items failed, what the main causes were and when fixes land. Leaders respond to a short list with owners and dates. It also builds a record, year over year, of a program that finds and corrects its own weaknesses, which is what a mature control environment looks like from the outside.
Quick check
Who should run the internal test?
Someone who does not operate the control, such as a peer from another team or an internal audit function.
Do I have to tell the auditor about findings?
If a finding affects a control in scope, it is wise to discuss it early. Ask your audit firm how they want it handled.
Last reviewed: 19 October 2026.
