Compliance and Substantive Testing

Tests are typically grouped into two

onboarding a new user, attempt to perform categories: compliance tests and substantive an authorized transaction, and then offboard tests. Compliance tests determine whether a that identity. Reviewing system logs would control both exists and functions as intended. confirm whether each step executed For example, an assessor might compare correctly and was properly recorded. a list of employees authorized to access a Because substantive testing system against the system's active user list, expecting them to match.

actively demonstrates how a control behaves in practice, Compliance tests are often it offers stronger assurance faster to conduct and provide that security measures are an important baseline functioning as designed.

for determining whether foundational requirements are

However, this depth of confirmation typically requires more planning, time, and being met.

organizational resources, making it essential Substantive tests go further by validating to balance both approaches within a broader the process itself. Using the same access assessment strategy. control example, the tester would simulate