The Testing Plan holds your tenancy's testing rules. Open it from Testing → Testing Plan.
What it sets, for each criticality
Setting | Means | Example defaults |
|---|---|---|
Frequency | How often controls of this criticality are tested, against your assessment cycle | Key: twice a cycle; Standard: once; Minor: every other cycle |
Pass line | At or above this %, the control is Effective | Key 95, Standard 85, Minor 70 |
Fail line | Below this %, it's Not effective and a finding is raised | Key 80, Standard 60, Minor 40 |
Lead time | How many days before it's due a test appears in the Back-Log |
It also holds the criticality bands: the rules that decide whether a control is Key, Standard or Minor. See Control Criticality.
Changing it
Like your risk appetite, the plan is changed as a draft and only takes effect when approved.
Make your changes and save the draft.
Someone who can approve it reviews and approves it.
Due dates are recalculated: a control that's become more critical is brought forward straight away; one that's become less critical changes after its next test.
Approving your own changes is allowed but recorded as self-approved. Your tenancy can require someone else to approve, in the tenancy settings.
Annual review
Review the plan once a year. The date is on the Calendar. Every approved version is kept.