Collecting proof - Automated control testing
Once you are collecting proof automatically using Hypersyncs, how do you know the proof is valid and provides the compliance evidence required? You could open each piece of proof manually and view it, but that is time-consuming and prone to errors. You may need to review hundreds of lines of data to determine whether or not the proof is valid. A better way is to configure automated control testing.
Automated control testing requires the use of a Hypersync on a control or a label to gather the proof automatically. Proof gathered by Hypersyncs follows a predictable table format allowing it to be tested easily.
Once a Hypersync is set up, you can configure a test to run on a schedule that you specify: on the most recent proof, on all proof, or on proof created in a particular date range. Hyperproof’s flexible test builder allows you to write many types of tests using simple business logic. It works similarly to popular spreadsheet functions like VLOOKUP(), HLOOKUP(), IF(), and more.
For example, if you have a control that requires that all passwords be 10 characters or more, you can use a Hypersync to retrieve proof that contains password length. Based on that proof, you can configure a test that checks the password length field to ensure that it is greater than or equal to 10. If not, the test fails, and you can address the issue.
Hyperproof’s notification system warns you about failed tests by email, Slack, or Teams depending on your configuration. You can also set up automatic event-driven repeating tasks for failed tests asking team members to review controls or labels, and the associated proof.
If a test fails, review the failure on the Tests tab of the control or label you are testing.
To use automated control testing:
Select the control you want to test.
Configure a Hypersync for the control or associated label to collect proof. See How does a Hyperproof user create a new Hypersync? and Hypersync overview.
Review the proof to determine what needs to be tested. See Viewing proof.
Configure a test to verify that the proof collected meets the criteria for the control. See Creating and running an automated control test.
For more information, see these workshops on automated control testing:
The importance of automated controls
Automated control testing