Separate the three questions
Design asks whether the control is capable of addressing the risk. Implementation asks whether the approved change has been put in place. Operating effectiveness asks whether it is applied consistently and achieves the intended result in practice. A policy, training record and system release each support different parts of that assessment; none automatically proves the whole.
Set a clear objective for each control. For example, a monitoring control should identify the relevant population and exceptions, allocate investigation and retain the decision. Testing only whether a toggle is switched on may miss whether the right customers are included or whether alerts are acted on. Select tests that examine the risk outcome, not merely the presence of a screen.
Build the test before looking for a pass
Record the population, period, sample rationale, procedure, expected evidence and acceptance criteria in advance. Include higher-risk cases, boundary situations and exceptions as well as routine cases. Use a random component where useful, but do not describe a judgemental sample as statistically representative.
There is no universal period or sample size that proves effectiveness for every control. Consider transaction volumes, control frequency, the severity of the original weakness and any specific regulatory requirement. A monthly governance control needs different evidence from an automated block that operates on each transaction. If the control has not operated enough times, state the limitation and the planned retest.
- Define the control objective and objective pass criteria.
- Reconcile the population and justify the sample and period.
- Reperform the control using dated source records.
- Investigate exceptions, assess impact and retest corrective changes.
Follow the decision all the way through
For each selected item, trace the input, decision, actor, timestamp, exception and retained output. Confirm that the control applied before the relevant event where timing matters. Check the method version, date format and clock basis; do not infer an approval time from the date a screenshot was taken.
Include negative tests where safe: a missing required field, an expired credential, a risk threshold boundary or an attempted action outside an authorised user’s access. Use a test environment or agreed controlled approach and never introduce an unsafe live transaction simply to demonstrate a block. A synthetic test supports configuration assurance; actual operating records support the real-world conclusion.
Challenge the result and keep the limitation visible
The tester should have sufficient independence from the work being assessed. Where complete organisational separation is not proportionate, document the arrangement and the independent challenge applied. Review exceptions individually and assess whether they indicate a wider issue. Do not average a serious exception away using a large number of routine passes.
A Board pack should explain the tests performed, results, unresolved risks and decisions required. Keep current operation distinct from historical remediation: a recent successful sample cannot recreate a decision record that was never retained. MEMA can help design the test and independently challenge the evidence, but the report must state exactly what it supports and must not imply automatic release from a regulatory restriction.
A fictional worked example
The starting point
The monitoring procedure was approved, so the control is effective.
A more useful approach
The procedure was approved and configured. Testing checked population coverage, generated alerts, investigation decisions and overdue exceptions over the justified review period. The result and remaining limitations are reported separately.
The evidence moves from intention to application and outcomes, with a defined boundary to the assurance.
Useful templates
Questions on this topic
3 questions
Can the same firm help remediate and independently review the work?
Potential conflicts and self-review risk need explicit assessment. Do not describe implementation work as independent assurance without explaining how independence is protected.
Depending on scope and risk, a separate reviewer, separate team or additional independent challenge may be needed. A statutory appointment may have its own requirements. Agree these arrangements before work starts.
How long must controls operate before effectiveness can be demonstrated?
There is no universal period. The appropriate observation window depends on control frequency, transaction volume, original risk and any specific FCA condition or agreed testing plan.
Explain why the period and sample are sufficient. If a new control has not operated often enough, report implementation separately and set a justified follow-up test.
What should the Board see about remediation?
Progress against defined milestones, unresolved material risks, overdue work, customer impact, exceptions, assurance results and decisions required. Explain what any completion percentage actually measures.
Record challenge, ownership and follow-through. A meeting or a dashboard alone does not establish that the underlying controls are effective.
Official sources and further reading
Read the underlying material alongside the request or requirement that applies to your firm. MEMA's workflow suggestions are not additional regulatory rules.
How MEMA can help
We can help interpret the scope, organise evidence, test controls or deliver a defined remediation workstream. Where independent assurance is required, the scope and reviewer separation are agreed explicitly.
Discuss your firm's position