Control Testing Agent
Gathers evidence and executes control tests during fieldwork.
Pulls the populations, draws the samples, fetches the evidence, and runs the control test, going full-population where the data allows. Documents the workpaper with tickmarks and exceptions noted, logs every step and evidence link for re-performance, and routes the conclusions to a reviewing audit agent.
Authority
Recommend for approval
Team role
Completes a defined task
Handoffs
Named collaborators
The role
What it owns and where its authority ends
Desk
Internal Audit
Desk workflow
Risk-based annual planning and scoping, then fieldwork (evidence gathering and control testing), then findings, reporting and issue follow-up, with conclusions re-checked by a reviewing audit agent and owned by the accountable audit executive.
Collaboration
Coordinates specialist contributions
Decision boundary
An accountable reviewer commits the decision or action.
Systems and capabilities involved
Source systems (read-only extracts)
Full-population analytics
Legacy GUI for evidence
screens that lack an API
Working-paper system
Reviewing audit agent
Handoffs
What this role gives and receives
Capabilities offered
The handoffs name the next owner or specialist and the work that moves between them.
Handoff to
Receives from
Receives from
Context
What the role needs to do the work
- Current work
- The control being tested + evidence gathered + exceptions so far.
- Prior interactions
- Prior-period results for the same control.
- Policies and reference
- Test procedures, sampling methodology, and what 'pass' means per control.
- Working method
- Evidence-pull recipes per system refined from reviewing-agent feedback.
Illustrative workflow
How the work moves
Starting point
Fieldwork on access-recertification control for a trading system.
- 01
Extract the full entitlement population and the recertification records.
- 02
Test the full population for recertified-vs-active and segregation-of-duties conflicts.
- 03
Document exceptions with evidence links in the workpaper.
Result
A completed workpaper testing the full population, 14 exceptions flagged with evidence links logged for re-performance.
Checks and boundaries
What must be tested or reviewed
- 01Reproducibility: every test step + evidence link is logged for re-performance.
- 02Sampling methodology validated; deviations flagged, not silently adjusted.
- 03A reviewing audit agent re-checks the conclusions and the accountable audit executive owns the opinion: the agent tests, the executive opines.
Human authority
An accountable reviewer commits the decision or action.
Keep exploring