Reporting control testing
Targeted tests of the automated and IT-dependent controls that protect report compilation, approval, and release.
When the application is already in production and the question is whether its controls actually operated in the period, we test them. Typical coverage includes access to report definitions, change promotion into the reporting layer, maker-checker on manual overlays, completeness of source extracts, and the lock that prevents silent re-runs after a pack has been released.
We design tests from the control description you already use for internal audit or from a walkthrough if that description is missing. Evidence is taken from system logs, ticket records, and the report run itself — not from a policy binder alone.
This engagement is often commissioned after an internal audit finding, ahead of an external statutory audit, or when a platform owner has changed. It can stand alone or feed the application financial audit.