Independently test an implemented control under the self-review rule

Head of internal audit: Independently test an implemented control under the self-review rule. Starts when: A control built by an implementer reaches operating. Steps: Assign a tester who took no part in the implementation; Test on a new cycle or sample; Record the result; Report to the committee. Done when: The control's level 4 score, if any, rests on a test record by someone who did not build it. Rules that apply: Self-review rule (framework overlay); Level 4 "Assured" requires independent testing.