Internal Controls Testing: Control Matrices, Sample Sizes & Deficiency Evaluation

What you'll build

What you will be able to do

Each lab ends with a concrete result that you build yourself and the checker confirms, cell by cell.

• Score ten controls in the risk and control matrix (RCM) of Tavenor Instruments Inc., rate them High / Medium / Low and count the key controls.
• Look up the sample size for eleven controls from their frequency and risk, estimate the testing hours and see how much of the work sits in the higher-risk controls.
• Evaluate eight attribute tests: the sample deviation rate, the upper deviation limit from a factor table, and whether each control can be relied on.
• Summarise the 2026 test results of 14 controls by process with COUNTIF and COUNTIFS: design results, operating exceptions and key controls that passed both tests.
• Find segregation-of-duties conflicts in the purchase-to-pay roles of eight users: one conflicting pair with SUMPRODUCT, then every user’s conflicts with a rule matrix.
• Classify eight control deficiencies by magnitude and likelihood with IFS, count the material weaknesses and test whether small deficiencies in one account add up to a bigger problem.
• Turn ten open findings into a remediation tracker at 30 Sep 2026: due dates, days overdue for items that are not closed, a count of overdue items and a red highlight on every overdue row.
• Build the year-end controls dashboard for the audit committee: testing coverage and pass rate per process, the overall pass rate and a stacked column chart of effective controls and exceptions.