Test of operating effectiveness (ToE)

Evidence that a control actually operated as designed, at the required frequency, throughout the period — by whom, how consistently, and with what result.

Operating effectiveness covers four things: that the control operated, that it operated as designed, that it operated by someone with the competence and authority to perform it, and that it did so throughout the period rather than in the fortnight before the auditor arrived.

The period point is where automation changes the answer most. A sample of twelve monthly reviews tells you about twelve moments; running the test against the population tells you about the period. Where a control is system-enforced, the distinction becomes sharper still — a configuration either was in place throughout or was not, and the change log settles it.

The other thing worth stating plainly: an approval is only evidence of operating effectiveness if the approver could have refused. Sign-off records with a 100% approval rate and a median review time of a few seconds are documentation of a workflow, not evidence that a control operated. This is the same failure mode that appears in approval gates for agent work, which is a useful thing to have noticed before you build them.