Lesson 3 of 5
Controls in testing
10 min
Most SAP test packs test that processes work. Fewer test that controls work, and fewer still test that controls stop what they should. A process owner can close that gap cheaply by adding control scenarios to the test library, so that the project's testing doubles as control evidence.
Test of design and test of operating effectiveness
| Test of design | Test of operating effectiveness | |
|---|---|---|
| Question | If it works as designed, would the control address the risk? | Did the control actually work, consistently, over the period? |
| When | Before go-live and after changes | Over a period after go-live, usually by internal and external audit |
| Evidence | Control description, configuration, a walkthrough of one instance | Samples across the period, or for automated controls a single instance plus effective ITGCs |
| Process owner's role | Confirm the design and the configured values | Keep the control operating and its evidence available |
Project testing is mainly a test of design and implementation: it shows the control is configured and behaves as intended. For automated controls, auditors commonly accept testing one instance, provided IT general controls show the configuration has not changed since. That is why a clean, well-evidenced control test in UAT can save real audit effort later. Ask your auditors early what they will rely on.
Positive and negative control tests
Every control needs at least two tests: one showing it lets valid transactions through, and one showing it stops invalid ones. The negative test is the one that proves the control.
| Control | Positive test | Negative test |
|---|---|---|
| Invoice price tolerance | Invoice for 500 CMC-RTR-200 at PO price posts without a block | Invoice at 6% above PO price posts with a payment block; the buyer cannot release it |
| Credit check | Order for Great Lakes Fleet Services within its limit can be delivered | Order exceeding the limit is blocked; delivery cannot be created until the credit team releases it |
| PO approval | PO below the threshold is output without approval | PO above $25,000 cannot be output until approved by the authorized approver |
| Posting periods | Posting into the open period succeeds | Posting into a closed period is rejected |
| Segregation of duties | Accounts payable clerk can post invoices | The same clerk cannot change supplier bank details or run payments |
Positive and negative tests for common controls.
Building the control-to-test map
- Risk and control matrixInternal control lists risks and the controls that address them
- Control in SAPProcess owner identifies the setting, role or report that implements each control
- Test scenariosPositive and negative scenarios added to the test library with expected results
- EvidenceConfiguration value, test documents, block or rejection proof
- Regression setControl scenarios flagged as mandatory for every release
Start from the company's risk and control matrix (RCM), maintained by internal control. For each control in your process, write down how SAP implements it and which test scenario proves it. Gaps appear quickly: a control in the RCM that relied on an ECC custom report that no longer exists, or a new S/4HANA approval workflow that is not yet in the RCM.
What would you do?
Priya's UAT pack shows the credit check scenario passed: an order for Great Lakes Fleet Services was created and delivered. Dan notices the order was within the credit limit. What is missing?
- Project testing is mainly a test of design; operating effectiveness is tested over a period after go-live.
- Every control needs a positive and a negative test; the negative test proves the control.
- Map each control in the risk and control matrix to its SAP implementation and test scenario.
- Run control tests with production-like roles, and keep control scenarios in the regression set.
Check your understanding · not graded
Lesson check
1. What does a test of operating effectiveness check?
2. Which test proves a credit check control?
3. Where should a process owner start mapping controls to tests?
4. Why run control tests with production-like roles?