Introduction
Control testing is an audit practice used to verify how well an organization's internal controls are functioning. It examines whether controls are properly designed, meaning capable of achieving their objective if they operate correctly, and consistently applied, meaning actually functioning as designed in practice. Control testing provides assurance to management, boards, and external stakeholders that the organization's internal controls are reliable and effective, and identifies weaknesses for remediation.
A robust control environment is a prerequisite for an effective governance, risk, and compliance (GRC) framework. It enables organizations to mitigate risks, safeguard sensitive information, ensure compliance with regulations, and maintain operational integrity.
However, implementing proper internal controls is an ongoing and complex process that requires regular evaluations to test their design and operational effectiveness. Risk officers and compliance managers are turning to technology to streamline and automate their internal controls for long-term, sustainable compliance, as paper-based manual processes, electronic document management, and generic desktop tools have proved inadequate.
This article provides a detailed overview of control testing, including its definition, types, advantages, best practices, the role played by technology, and more.
Key Takeaways
- Control testing evaluates the design and operational effectiveness of internal controls in mitigating risks and adhering to regulatory requirements, and helps in maintaining data integrity, fostering accountability, and preventing fraud.
- Common methods for testing controls include inquiry, observation, examination of evidence, re-performance, and Computer-Assisted Audit Techniques (CAATs).
- Benefits of control testing include identifying weaknesses in controls, ensuring compliance with regulations, improving operational efficiency, maintaining financial integrity, and protecting information security.
- Best practices for effective control testing include clearly defining control objectives, adopting a risk-based approach, ensuring tester competence and independence, using the right tools and technologies, and documenting and communicating findings.
What is Control Testing?
Control testing is an audit practice used to verify how well an organization’s internal controls are functioning. It examines whether the controls are properly designed and consistently applied to detect or prevent errors, misstatements, or compliance issues. In simple terms, it ensures that the organization’s “safety nets” are reliable and effective.
Purpose of Control Testing
Control testing aims to evaluate whether internal controls are sufficient to detect or prevent potential errors or misstatements.
Its key purposes include:
- Assurance
- Improvement
Control testing serves a dual purpose: assurance and improvement.
From an assurance perspective, it provides senior management and external stakeholders with the confidence that the organization's internal controls are effectively managing risks related to financial reporting, compliance, and operational efficiency. This assurance is critical in today’s complex regulatory environment, where demonstrating compliance with standards and regulations can significantly impact a company's reputation and financial health.
From an improvement standpoint, control testing identifies weaknesses and inefficiencies in current control measures, offering invaluable insights into areas where enhancements are needed. It acts as a feedback mechanism, guiding organizations in refining their risk management practices and control processes. By addressing these vulnerabilities promptly, companies can prevent potential financial losses, avoid regulatory penalties, and enhance their operational effectiveness, thereby securing their long-term growth and stability.
Types of Control Testing
The primary types of control testing include:
- Inquiry: This involves questioning relevant personnel to understand the design and implementation of controls. It’s like getting a pulse check from the people closest to the process. While insightful, inquiry alone cannot validate control effectiveness; it’s more about uncovering the "what" and "why" behind the controls.
- Observation: By observing processes in real time, auditors assess how controls operate in practice. For example,, witnessing the approval process for financial transactions highlights compliance with established policies. While revealing, observation can be influenced by the knowledge that an audit is taking place.
- Inspection of Evidence: This method dives into documentation to verify control performance. Auditors might review signed contracts, system logs, or approval records. The focus is on tracing proof of compliance and identifying gaps, ensuring a solid audit trail is in place.
- Re-performance: Re-performing a control involves replicating it to confirm its accuracy. For example, an auditor might recompute inventory valuation or verify reconciliations. This hands-on approach doesn’t rely on assumptions, delivering a definitive measure of how well controls function.
- Computer-Assisted Audit Technique (CAATs): In a tech-driven world, CAATs bring accuracy and speed to control testing. These techniques leverage software tools to analyze data, simulate scenarios, and identify discrepancies. Whether it’s auditing system configurations or spotting anomalies in large datasets, CAATs make audits smarter and much more robust.
| Method | Description | Best Used For | Limitation |
| Inquiry | Asking control owners how a control works | Understanding intent; gathering context | Cannot alone establish effectiveness; needs corroboration |
| Observation | Watching a control being performed in real time | High-frequency manual controls | Snapshot only; observer effect may improve performance |
| Examination of Evidence | Reviewing documents, logs, records, or artefacts | High-volume transactional and automated controls | Only as good as documentation quality |
| Re-performance | Independently re-executing a control to verify results | Complex calculations; reconciliations | Time-intensive; requires technical expertise |
| CAATs | Software tools to test 100% of a population | Large datasets; automated controls | Requires data access and technical skills |
How to Conduct Control Testing: A Step-by-Step Process
Effective control testing follows a structured methodology that ensures controls are evaluated consistently, evidence is reliable, and findings are actionable. While the exact approach may vary by organization, the core process typically includes the following steps:
Step 1: Define the Control Objective and Scope
Begin by identifying the specific control being tested, the risk it is intended to mitigate, and the objective of the test. This includes clarifying whether the control is preventive or detective, manual or automated, and determining the systems, business processes, locations, or regulatory requirements within scope. A clearly defined scope prevents inefficient testing and ensures the results are meaningful.
Step 2: Understand the Control Design
Before testing effectiveness, confirm how the control is intended to operate. Review policies, process documentation, control descriptions, system configurations, and ownership details to understand the expected frequency, triggering conditions, approval requirements, and evidence trail. If a control is poorly designed, operational testing will not provide useful assurance.
Step 3: Select the Testing Methodology
Choose the testing approach based on the nature of the control and the level of assurance required. Common methods include inquiry, observation, inspection of documentation, reperformance, and automated testing, where applicable. The methodology should align with the control’s design and the reliability of available evidence.
Step 4: Define the Sample Population and Testing Criteria
For controls that do not operate continuously across all transactions, identify the relevant population and determine an appropriate sample for testing. Sampling should reflect the control frequency, transaction volume, risk level, and any applicable internal or regulatory testing standards. Clear pass-fail criteria should be established before execution begins.
Step 5: Execute the Test and Collect Evidence
Perform the testing according to the defined methodology and gather sufficient evidence to support the outcome. Evidence may include approval logs, system screenshots, audit trails, reconciliations, exception reports, or workflow records. Documentation should be complete enough for independent review and validation.
Step 6: Evaluate Results and Identify Deficiencies
Assess whether the control operated as designed throughout the testing period. Any exceptions should be evaluated to determine whether they represent isolated errors, control design weaknesses, or recurring operating failures. Findings should be assessed in the context of the underlying risk and potential business impact.
Step 7: Document Findings and Track Remediation
Record the test outcome, supporting evidence, identified issues, root cause observations, and recommended corrective actions. Where deficiencies are identified, assign ownership, establish remediation timelines, and monitor progress through closure. Control testing creates value when findings lead to measurable control improvement.
Design Effectiveness vs Operating Efectiveness
Design effectiveness and operating effectiveness answer two very different questions about a control. Here are some key differences:
| Parameter | Design effectivenes | Operating effectiveness |
| Definition | Determines whether a control is appropriately structured to prevent or detect risk. | Determines whether the control performs consistently during real operations. |
| Primary question | Is the control capable of addressing the risk if followed correctly? | Is the control actually being followed and producing the intended result? |
| When assessed | During control creation, redesign, or major process change. | During routine testing cycles or ongoing monitoring. |
| Evidence required | Policies, procedures, process flows, and system configurations. | Transaction samples, logs, approvals, and execution records. |
| Assessment methods | Walkthroughs, documentation review, and control mapping. | Sampling, observation, reperformance, and automated monitoring. |
| Typical remediation | Redesign the control or clarify ownership and procedures. | Correct execution gaps, retrain users, or strengthen monitoring. |
Control Testing in Practice: Financial Services Example
Consider a bank's access control requiring dual authorization for payment approvals above $10,000. To test operating effectiveness, an auditor would review a sample of 25 payment approvals and verify that dual approval was obtained for each transaction above the threshold. Any transaction approved by a single authorizer represents a control exception requiring investigation, root cause analysis, and remediation reporting. This example illustrates how operating effectiveness testing moves beyond documentation review to verify that controls are functioning as designed in actual transactions.
Why is Control Testing Important?
Control testing is crucial for organizations as it identifies weaknesses in controls, mitigates risks, ensures compliance with legal and industry standards, enhances operational efficiency, supports financial integrity, and protects information security.
Here are the key benefits:
- Identifies Weaknesses in Controls: Early detection of vulnerabilities allows organizations to address them before they escalate into serious issues or losses.
- Mitigates Risks: Effective control testing helps to proactively identify and mitigate risks before they snowball into a major problem, obstructing an organization from reaching its goal.
- Ensures Compliance: With a constantly changing business landscape, control testing verifies that controls meet current legal, regulatory, and industry standards, helping avoid fines and penalties.
- Operational Efficiency: Identifying and correcting inefficiencies in processes through control testing can lead to smoother, more efficient operational flows.
- Financial Integrity: By ensuring the accuracy and reliability of financial reporting, control testing supports trust and confidence among investors, creditors, and other stakeholders.
- Information Security: It helps protect sensitive data from breaches and unauthorized access, preserving the integrity and confidentiality of information.
Best Practices for Control Testing Effectively
Here are some of the best practices for control testing in an organization:
- Understand and Define Control Objectives Clearly: Before initiating control testing, it’s imperative to have a clear understanding of what each control aims to achieve. Defining control objectives helps in aligning the tests accurately with the expected outcomes. This clarity supports targeted testing and ensures that the control effectiveness is evaluated against the intended criteria.
- Adopt a Risk-Based Approach: Not all controls are created equal, and their significance varies depending on the risks they mitigate. Adopting a risk-based approach to control testing involves prioritizing controls that mitigate your organization's most critical risks. This ensures efficient use of resources by focusing on areas with the highest potential impact.
- Ensure Tester Competence and Independence: Control testers should have the necessary skills, knowledge, and impartiality to conduct tests effectively. Ensuring the competence and independence of testers helps in obtaining objective and reliable testing outcomes, enhancing the credibility of the testing process.
- Document and Communicate Findings: Document all findings from control tests clearly and concisely, including descriptions of tests performed, results obtained, and recommendations for improvement. Communicate these findings to relevant stakeholders promptly to ensure that necessary corrective actions are taken.
- Utilize the Right Tools and Technologies: Implementing the appropriate tools and technology can significantly enhance the efficiency and accuracy of control tests. Automation tools, for instance, can streamline repetitive tasks, reduce errors, and provide real-time reporting capabilities. Investing in technology is investing in the future-proofing of your control testing processes.
How MetricStream Can Help
As you seek to refine your control testing strategies, consider the power of technology and the value of partnering with a proven GRC leader like MetricStream.
MetricStream Control Testing helps organizations streamline their control environment with a structured control library, common taxonomy, and well-defined control testing process. Organizations can create control test plans, execute the tests, record control deficiencies, and report on the performance of controls. Control deficiencies are recorded as issues that are then routed for further investigation, action planning, and remediation.
To learn more about how MetricStream Control Testing can help, request a personalized demo today.
Control testing is an audit practice used to verify how well an organization's internal controls are functioning. It examines whether controls are properly designed, meaning capable of achieving their objective if they operate correctly, and consistently applied, meaning actually functioning as designed in practice. Control testing provides assurance to management, boards, and external stakeholders that the organization's internal controls are reliable and effective, and identifies weaknesses for remediation.
A robust control environment is a prerequisite for an effective governance, risk, and compliance (GRC) framework. It enables organizations to mitigate risks, safeguard sensitive information, ensure compliance with regulations, and maintain operational integrity.
However, implementing proper internal controls is an ongoing and complex process that requires regular evaluations to test their design and operational effectiveness. Risk officers and compliance managers are turning to technology to streamline and automate their internal controls for long-term, sustainable compliance, as paper-based manual processes, electronic document management, and generic desktop tools have proved inadequate.
This article provides a detailed overview of control testing, including its definition, types, advantages, best practices, the role played by technology, and more.
- Control testing evaluates the design and operational effectiveness of internal controls in mitigating risks and adhering to regulatory requirements, and helps in maintaining data integrity, fostering accountability, and preventing fraud.
- Common methods for testing controls include inquiry, observation, examination of evidence, re-performance, and Computer-Assisted Audit Techniques (CAATs).
- Benefits of control testing include identifying weaknesses in controls, ensuring compliance with regulations, improving operational efficiency, maintaining financial integrity, and protecting information security.
- Best practices for effective control testing include clearly defining control objectives, adopting a risk-based approach, ensuring tester competence and independence, using the right tools and technologies, and documenting and communicating findings.
Control testing is an audit practice used to verify how well an organization’s internal controls are functioning. It examines whether the controls are properly designed and consistently applied to detect or prevent errors, misstatements, or compliance issues. In simple terms, it ensures that the organization’s “safety nets” are reliable and effective.
Control testing aims to evaluate whether internal controls are sufficient to detect or prevent potential errors or misstatements.
Its key purposes include:
- Assurance
- Improvement
Control testing serves a dual purpose: assurance and improvement.
From an assurance perspective, it provides senior management and external stakeholders with the confidence that the organization's internal controls are effectively managing risks related to financial reporting, compliance, and operational efficiency. This assurance is critical in today’s complex regulatory environment, where demonstrating compliance with standards and regulations can significantly impact a company's reputation and financial health.
From an improvement standpoint, control testing identifies weaknesses and inefficiencies in current control measures, offering invaluable insights into areas where enhancements are needed. It acts as a feedback mechanism, guiding organizations in refining their risk management practices and control processes. By addressing these vulnerabilities promptly, companies can prevent potential financial losses, avoid regulatory penalties, and enhance their operational effectiveness, thereby securing their long-term growth and stability.
The primary types of control testing include:
- Inquiry: This involves questioning relevant personnel to understand the design and implementation of controls. It’s like getting a pulse check from the people closest to the process. While insightful, inquiry alone cannot validate control effectiveness; it’s more about uncovering the "what" and "why" behind the controls.
- Observation: By observing processes in real time, auditors assess how controls operate in practice. For example,, witnessing the approval process for financial transactions highlights compliance with established policies. While revealing, observation can be influenced by the knowledge that an audit is taking place.
- Inspection of Evidence: This method dives into documentation to verify control performance. Auditors might review signed contracts, system logs, or approval records. The focus is on tracing proof of compliance and identifying gaps, ensuring a solid audit trail is in place.
- Re-performance: Re-performing a control involves replicating it to confirm its accuracy. For example, an auditor might recompute inventory valuation or verify reconciliations. This hands-on approach doesn’t rely on assumptions, delivering a definitive measure of how well controls function.
- Computer-Assisted Audit Technique (CAATs): In a tech-driven world, CAATs bring accuracy and speed to control testing. These techniques leverage software tools to analyze data, simulate scenarios, and identify discrepancies. Whether it’s auditing system configurations or spotting anomalies in large datasets, CAATs make audits smarter and much more robust.
| Method | Description | Best Used For | Limitation |
| Inquiry | Asking control owners how a control works | Understanding intent; gathering context | Cannot alone establish effectiveness; needs corroboration |
| Observation | Watching a control being performed in real time | High-frequency manual controls | Snapshot only; observer effect may improve performance |
| Examination of Evidence | Reviewing documents, logs, records, or artefacts | High-volume transactional and automated controls | Only as good as documentation quality |
| Re-performance | Independently re-executing a control to verify results | Complex calculations; reconciliations | Time-intensive; requires technical expertise |
| CAATs | Software tools to test 100% of a population | Large datasets; automated controls | Requires data access and technical skills |
How to Conduct Control Testing: A Step-by-Step Process
Effective control testing follows a structured methodology that ensures controls are evaluated consistently, evidence is reliable, and findings are actionable. While the exact approach may vary by organization, the core process typically includes the following steps:
Step 1: Define the Control Objective and Scope
Begin by identifying the specific control being tested, the risk it is intended to mitigate, and the objective of the test. This includes clarifying whether the control is preventive or detective, manual or automated, and determining the systems, business processes, locations, or regulatory requirements within scope. A clearly defined scope prevents inefficient testing and ensures the results are meaningful.
Step 2: Understand the Control Design
Before testing effectiveness, confirm how the control is intended to operate. Review policies, process documentation, control descriptions, system configurations, and ownership details to understand the expected frequency, triggering conditions, approval requirements, and evidence trail. If a control is poorly designed, operational testing will not provide useful assurance.
Step 3: Select the Testing Methodology
Choose the testing approach based on the nature of the control and the level of assurance required. Common methods include inquiry, observation, inspection of documentation, reperformance, and automated testing, where applicable. The methodology should align with the control’s design and the reliability of available evidence.
Step 4: Define the Sample Population and Testing Criteria
For controls that do not operate continuously across all transactions, identify the relevant population and determine an appropriate sample for testing. Sampling should reflect the control frequency, transaction volume, risk level, and any applicable internal or regulatory testing standards. Clear pass-fail criteria should be established before execution begins.
Step 5: Execute the Test and Collect Evidence
Perform the testing according to the defined methodology and gather sufficient evidence to support the outcome. Evidence may include approval logs, system screenshots, audit trails, reconciliations, exception reports, or workflow records. Documentation should be complete enough for independent review and validation.
Step 6: Evaluate Results and Identify Deficiencies
Assess whether the control operated as designed throughout the testing period. Any exceptions should be evaluated to determine whether they represent isolated errors, control design weaknesses, or recurring operating failures. Findings should be assessed in the context of the underlying risk and potential business impact.
Step 7: Document Findings and Track Remediation
Record the test outcome, supporting evidence, identified issues, root cause observations, and recommended corrective actions. Where deficiencies are identified, assign ownership, establish remediation timelines, and monitor progress through closure. Control testing creates value when findings lead to measurable control improvement.
Design effectiveness and operating effectiveness answer two very different questions about a control. Here are some key differences:
| Parameter | Design effectivenes | Operating effectiveness |
| Definition | Determines whether a control is appropriately structured to prevent or detect risk. | Determines whether the control performs consistently during real operations. |
| Primary question | Is the control capable of addressing the risk if followed correctly? | Is the control actually being followed and producing the intended result? |
| When assessed | During control creation, redesign, or major process change. | During routine testing cycles or ongoing monitoring. |
| Evidence required | Policies, procedures, process flows, and system configurations. | Transaction samples, logs, approvals, and execution records. |
| Assessment methods | Walkthroughs, documentation review, and control mapping. | Sampling, observation, reperformance, and automated monitoring. |
| Typical remediation | Redesign the control or clarify ownership and procedures. | Correct execution gaps, retrain users, or strengthen monitoring. |
Control Testing in Practice: Financial Services Example
Consider a bank's access control requiring dual authorization for payment approvals above $10,000. To test operating effectiveness, an auditor would review a sample of 25 payment approvals and verify that dual approval was obtained for each transaction above the threshold. Any transaction approved by a single authorizer represents a control exception requiring investigation, root cause analysis, and remediation reporting. This example illustrates how operating effectiveness testing moves beyond documentation review to verify that controls are functioning as designed in actual transactions.
Control testing is crucial for organizations as it identifies weaknesses in controls, mitigates risks, ensures compliance with legal and industry standards, enhances operational efficiency, supports financial integrity, and protects information security.
Here are the key benefits:
- Identifies Weaknesses in Controls: Early detection of vulnerabilities allows organizations to address them before they escalate into serious issues or losses.
- Mitigates Risks: Effective control testing helps to proactively identify and mitigate risks before they snowball into a major problem, obstructing an organization from reaching its goal.
- Ensures Compliance: With a constantly changing business landscape, control testing verifies that controls meet current legal, regulatory, and industry standards, helping avoid fines and penalties.
- Operational Efficiency: Identifying and correcting inefficiencies in processes through control testing can lead to smoother, more efficient operational flows.
- Financial Integrity: By ensuring the accuracy and reliability of financial reporting, control testing supports trust and confidence among investors, creditors, and other stakeholders.
- Information Security: It helps protect sensitive data from breaches and unauthorized access, preserving the integrity and confidentiality of information.
Here are some of the best practices for control testing in an organization:
- Understand and Define Control Objectives Clearly: Before initiating control testing, it’s imperative to have a clear understanding of what each control aims to achieve. Defining control objectives helps in aligning the tests accurately with the expected outcomes. This clarity supports targeted testing and ensures that the control effectiveness is evaluated against the intended criteria.
- Adopt a Risk-Based Approach: Not all controls are created equal, and their significance varies depending on the risks they mitigate. Adopting a risk-based approach to control testing involves prioritizing controls that mitigate your organization's most critical risks. This ensures efficient use of resources by focusing on areas with the highest potential impact.
- Ensure Tester Competence and Independence: Control testers should have the necessary skills, knowledge, and impartiality to conduct tests effectively. Ensuring the competence and independence of testers helps in obtaining objective and reliable testing outcomes, enhancing the credibility of the testing process.
- Document and Communicate Findings: Document all findings from control tests clearly and concisely, including descriptions of tests performed, results obtained, and recommendations for improvement. Communicate these findings to relevant stakeholders promptly to ensure that necessary corrective actions are taken.
- Utilize the Right Tools and Technologies: Implementing the appropriate tools and technology can significantly enhance the efficiency and accuracy of control tests. Automation tools, for instance, can streamline repetitive tasks, reduce errors, and provide real-time reporting capabilities. Investing in technology is investing in the future-proofing of your control testing processes.
As you seek to refine your control testing strategies, consider the power of technology and the value of partnering with a proven GRC leader like MetricStream.
MetricStream Control Testing helps organizations streamline their control environment with a structured control library, common taxonomy, and well-defined control testing process. Organizations can create control test plans, execute the tests, record control deficiencies, and report on the performance of controls. Control deficiencies are recorded as issues that are then routed for further investigation, action planning, and remediation.
To learn more about how MetricStream Control Testing can help, request a personalized demo today.
Frequently Asked Questions
Control testing is an audit practice used to verify how well an organization's internal controls are functioning, examining whether controls are properly designed and consistently applied to detect or prevent errors, misstatements, or compliance issues. It provides assurance to management, boards, and external stakeholders that the organization's internal controls are reliable and effective, and identifies weaknesses for remediation.
Design effectiveness testing assesses whether a control is capable of preventing or detecting the risk it is designed to address, asking whether the control is correctly structured for its purpose. Operating effectiveness testing assesses whether the control is actually functioning as designed in practice, asking whether people are following it and whether automated controls are correctly configured.
The five primary control testing methods are Inquiry, which involves asking control owners how a control functions; Observation, which involves watching a control being executed in real time; Examination of Evidence, which involves reviewing documentation and records; Re-performance, which involves independently re-executing a control to verify results; and Computer-Assisted Audit Techniques, which use software to test the full population of transactions.
Testing frequency depends on risk level, regulatory importance, and control type, with high-risk controls in SOX, HIPAA, and PCI DSS environments typically requiring quarterly or continuous testing, medium-risk controls tested semi-annually, and lower-risk controls tested annually. The broader trend in GRC is toward continuous automated testing across the full control population rather than periodic sample-based assessments.
Continuous control monitoring is the automated, real-time assessment of control operating effectiveness across the full population of transactions or events, replacing periodic point-in-time testing that leaves gaps between assessment cycles. It is increasingly expected by regulators in financial services under DORA, SOX Section 404 compliance, and cybersecurity frameworks, including NIST CSF, and is a core capability of modern GRC platforms.
Under Sarbanes-Oxley Section 404, public companies must assess the effectiveness of their internal controls over financial reporting as of fiscal year-end, with external auditors independently attesting to management's assessment. Control testing is the mechanism through which both management and auditors gather evidence of control effectiveness, covering entity-level controls, IT general controls, and financial reporting process controls per PCAOB Auditing Standard AS 2201.
Control testing documentation should capture the control objective, the testing procedure performed, sample details including population size and selection criteria, test results including any exceptions found, a conclusion on whether the control is operating effectively, and a remediation plan if exceptions were identified. Documentation should be sufficient for an independent reviewer to understand what was tested and how conclusions were reached.
When a control test identifies a failure, the exception is logged with details of what failed and why. Root cause analysis determines whether it is an isolated incident or a systematic weakness, the risk owner assesses whether the failure caused actual losses or compliance breaches, and a remediation plan is developed with specific actions and deadlines. After remediation, the control is retested to verify that the weakness has been addressed.
Best practices for control testing include defining clear control objectives before testing begins, using a risk-based approach to prioritize the highest-risk controls, ensuring tester independence so the tester is not the same person who operates the control, using the right testing method for each control type, selecting appropriate sample sizes, and documenting all test procedures and results to support audit review and communicate findings to control owners.
MetricStream's Audit and Controls platform provides a centralized control library with risk-to-control mappings, structured test plan creation with sample management and evidence attachment, workflow-driven test execution with findings and exception management, and continuous control monitoring through AiSPIRE that evaluates the full control population in real time. MetricStream is ranked number one in the Internal Audit category by Chartis Research.
