A completed test is a successful test
The most useful tests are the ones that find a problem. So a test succeeds when it's completed, whatever it finds. Failing a control isn't failing the test.
One test per control, per unit
A test checks one control on one unit. If the same control protects two units (the same guard on two machines, say), each is tested in its own right.
The result is a percentage
The tester works through the control's checklist. Conform suggests an effectiveness % from the answers, and the tester confirms or adjusts it. The Testing Plan sets a pass line and a fail line for each criticality:
Result | Outcome | What happens |
|---|---|---|
At or above the pass line | Effective | The control is proven. |
Between the lines | Partially effective | An observation. The tester can raise a finding. |
Below the fail line | Not effective | A finding is raised. |
Testing feeds the assessment, it doesn't overwrite it
Testing never changes your risk scores itself. It proposes changes and flags the unit for its next assessment, where the assessor decides. See The improvement loop.
Claimed vs proven
The headline of testing is how much of the risk reduction your assessments claim is actually proven by recent, effective tests. See The Assurance Picture.
When tests happen
Regular tests fall between assessments on the same calendar grid as your assessment cycle, so testing work doesn't land on top of assessment work. More critical controls are tested more often. Retests and extra tests never move the regular schedule.