# Design test steps for a control and pick a sample size

Builds a test of design and operating effectiveness for one control, with sample size, attributes to check, and exception handling.

- Topic: Legal & Compliance
- Framework: RTF
- Level: Standard
- Tags: Legal, Analyze, Fill-in Template
- Source: https://www.thinkwithprompt.com/prompts/design-test-steps-for-a-control-and-pick-a-sample-size

## Prompt

```text
Help me design a test for a control.

**Control description:** [WHO does WHAT, WHEN, HOW, and what evidence is kept]
**Risk it addresses:** [RISK]
**Control type and frequency:** [manual / automated; annual, quarterly, monthly, weekly, daily, multiple times a day]
**Population:** [what the full population is and roughly how many items in the period]
**Period under review:** [DATES]
**Our methodology or sampling guidance (if any):** [PASTE or "none"]
**Reliance level:** [e.g. SOX key control, internal audit, second-line monitoring]

Give me:
1. **Test of design** - steps to confirm the control, as described, would address the risk (precision, timing, competence of the performer, information used).
2. **Test of operating effectiveness** - numbered steps, written so a junior auditor can follow them.
3. **Sample size** - based on my methodology if I gave one; otherwise a commonly used frequency-based table, clearly labeled as a reference to confirm with my team's methodology.
4. **Sample selection approach** - random, haphazard, or targeted, and how to prove the population is complete.
5. **Attributes to test** - a checklist table, one row per attribute, with what counts as a pass.
6. **Information used in the control** - how to test the completeness and accuracy of any report the control relies on.
7. **Exception handling** - what to do if I find one exception (expand sample? deficiency?) and what to document.
8. **Automated control alternative** - if relevant, a test-of-one approach plus the IT general controls it depends on.
```

## What to fill in

- WHO does WHAT, WHEN, HOW, and what evidence is kept
- RISK
- DATES
- PASTE or "none"
- e.g. SOX key control, internal audit, second-line monitoring

Free to copy and use. From ThinkWithPrompt (https://www.thinkwithprompt.com/), a library of 2,663 curated AI prompts.