The following changes are aimed for 2014:
Integration of control performance and control testing in the tool.
Only upload the requested samples in the tool.
BPO-IC person will “validate” the assessment of the control performer. This will be done in the same workflow. Thus the control performance as well as the test is all in one place – you will not need to search the evidence, before you test it, it will be here.
Controls rejected by BPO-IC’s will revert back to the control performer for re-work.
Creating remediation plans will be enforced by the tool.
Move to a quarterly heartbeat for all testing. All daily, weekly and monthly controls will become quarterly tasks in the tool.
This means that these tasks should be :-
The reported in the tool once every quarter.
The upload of evidence thus might contain data from more than one control instance.
only the data that is a part of the requested sample. E.g. for a weekly performed control, in order to evidence it quarterly – evidence for selected weeks needs to be uploaded.
More guidance on these samples will follow.
Please be aware that any ‘central report’ controls that are currently not mapped in your framework will be challenged during future reviews and audits for inclusion.