How to explain a control test in a GRC or IT audit interview

Explain a control test by stating the requirement, the records and population you examined, the procedure you performed, the result, and the limit of your conclusion. A reader should be able to distinguish your work from the control owner's activity.

“I checked that access was removed” leaves too much unstated. Removed from which system? For whose accounts? Against what deadline? Did you examine a ticket or the system's recorded status? Those details make the explanation useful.

The case below is fictional interview practice. It is not a prescribed audit program or evidence of professional experience.

Begin with an explicit requirement

At fictional Calder Works, a practice policy requires interactive accounts in its scheduling application to be disabled by 18:00 local time on an employee's last working day. The policy excludes service accounts from this particular procedure; they have a separate process. The exercise asks you to examine three named departures from August.

This gives you a deadline and a defined account type. It does not establish that the three departures are the complete August population. Say that before presenting a conclusion about the month.

Your objective is to determine whether the supplied system records show timely disabling for those three people. You are not evaluating every access control in the organization.

Build a small procedure you can explain

Request the departure records, the mapping from each person to their scheduling account, and account-status events with their time-zone definitions. Compare the last working day and deadline with the disabling event for each mapped account. Record unresolved identity matches instead of guessing.

For a real engagement, establish the population and selection approach under its methodology. Three illustrative records are not a recommended sample size. If the employer asks how you would choose a sample, ask about the population, frequency, risk and applicable assessment approach before supplying a number.

Assume all listed times use the same local time zone. Without that assumption or its verification, the comparison could be wrong.

Keep different results separate

CW-02 has a supplied event after the deadline. CW-03 lacks the system evidence needed to establish a time. Calling both “failed accounts” hides the distinction between an observed timing exception and an unresolved evidence gap.

For CW-02, confirm the account mapping and timestamp meaning, then ask the owner for the explanation and any relevant exception record. An explanation is useful context; it does not change the supplied requirement automatically.

For CW-03, ask for the account event or another reliable record that can establish disabling. A closed ticket might record the completion of administrative work rather than the moment access stopped. Clarify what it represents.

Do not infer that either person used the account after departure. The records here concern disabling, not subsequent activity.

A concise interview answer

In this fictional exercise, I compared three supplied departure dates with disabling events for the corresponding scheduling accounts. The criterion was disabling by 18:00 on the last working day. One record met that deadline, one showed a later disabling event, and one had only a ticket closure, so its disabling time remained unverified. I would validate the late event with the owner and request stronger evidence for the unresolved record. I could report those three results, but I could not conclude that the whole August process was effective without establishing the population and assessment scope.

The answer contains enough detail for a follow-up. You do not need to read every field from the worksheet aloud. Keep the detailed record available to explain how you reached each result.

Use assessment terminology carefully

In ordinary conversation, “control testing” can describe a broad body of assessment work. Formal methodologies may distinguish specific methods. NIST's definition of examine includes inspecting and analyzing assessment objects to obtain evidence. Reviewing the records in this exercise should not be presented as having exercised the live account-disabling mechanism.

NIST SP 800-53A Rev. 5 provides assessment guidance that can be tailored to organizational circumstances. The procedure above is our teaching example, not a NIST assessment procedure or a certification checklist.

Practice the follow-up

Suppose the interviewer supplies a valid CW-03 account event showing disabling at 16:25 on August 21. Update that record to within the deadline and note the new evidence. Leave the CW-02 exception and the population limitation intact. New evidence should change the conclusion it addresses, not erase unrelated limitations.

Use the free evidence worksheet to record your procedure and follow-up. For more original cases and explained answers, inspect the Interview Case Workbook preview. Browse the field notes for related preparation.

For help obtaining usable records, read the complete evidence-request example.

Compare the audit-workpaper practice path to inspect a separate free exercise, the actual book fit and sample boundaries.

Follow the finding through corrective work

A later completed ticket does not automatically settle the original finding. Work through the remediation-closure evidence case, then compare the portfolio preparation options if you need broader practice connecting records and revised conclusions.

Explain how records entered the workpaper

A result also depends on the set examined. Write an audit sample-selection note that distinguishes the target population, export and selected records. Compare the sample-selection preparation options when choosing between a short free exercise and a connected portfolio project.

Review continuing access separately

Timely account disabling and the continuing need for a privileged role are different questions. Write a privileged-access review note, then inspect portfolio preparation options for a broader connected exercise.

Choose the next evidence exercise by the unresolved question

Use the same discipline when an interviewer changes the record. Keep one conclusion for each question instead of treating every missing item as the same problem.

Start with the free example closest to your uncertainty. The preparation comparisons explain when a short exercise is enough and when the existing portfolio material may help. None turns this fictional work into professional audit experience.