4.3.3. Control Testing and Evaluation
💡 First Principle: A control that passed its last test is a control that worked under yesterday's conditions — configuration drift, business change, and evolving threats mean effectiveness has to be re-verified on a cycle, not assumed to be permanent.
Control testing ranges from automated continuous control monitoring (checking configuration state against a defined baseline in near real time) to periodic manual testing and formal audit. A control that passed an audit twelve months ago can fail silently well before the next audit cycle — through a configuration change, a business process change that routed around it, or a new technique that defeats the control's original design — which is exactly why retesting cadence, not just initial testing, is what the exam expects a mature program to plan for. Testing asks two separate questions: design effectiveness (if the control operates as intended, would it address the risk?) and operating effectiveness (is it actually operating that way, consistently, over time?). Testing should be risk-based, with frequency and rigor scaled to the control's criticality and the consequence of an undetected failure rather than one uniform cadence, and scenarios should vary, since a control that only ever passes the same scripted test is proven against that one scenario. Continuous monitoring and periodic audit are complementary: automated monitoring catches drift from a baseline quickly (but only helps if its alerts are reviewed and acted on promptly), while an audit applies judgment to whether the control's design still fits current risk.
⚠️ Exam Trap: A control that passed testing once is sometimes assumed to remain effective indefinitely. The correct answer recognizes that controls require periodic retesting, since drift and change degrade effectiveness over time even without any single dramatic failure event.
Reflection Question: An access control passed its annual audit eleven months ago. A system change two months ago inadvertently widened its scope. What's the risk of relying solely on the annual audit cycle to catch this?
