Testing 1,2,3…

Written by David vun Kannon Posted March 20, 2007

David vun Kannon was one of the first Co-Chairs of the XBRL Specification Working Group and has been an Editor of every version of the XBRL Specification. He is a Director for PricewaterhouseCoopers, LLP.

In my last blog entry, I discussed how capturing the controls hierarchy of a company as an XBRL taxonomy could benefit from a direct tie-in to the financial data that is also in XBRL. In this post, I'll show how to extend the controls hierarchy in a different direction, down into the actual testing of controls.

There is a good reason to separate the testing of controls from the controls themselves. Controls testing is the job of two separate and distinct organizations. On the one hand is management, on the other, the external auditor. Both can have distinct testing strategies. So the controls taxonomy can be extended by either group with distinct testing taxonomy extensions.

To go back to the bank example I've used previously, a single control such as Videotape cash collection activity can be tested in several ways:

• The videos can be reviewed to see if they actually catch anyone trying to steal cash;
• The employees can be interviewed to see if they feel that the videotaping is a strong deterrent;
• The cash collection can be reperformed while attempting to hide a theft from the camera.

Most controls tests will fall into this broad outline of review, interview, or reperformance.

The result of a test is a judgment of the effectiveness of a control. This judgment is in effect a business measurement on a certain day, the value of test X of control Y of entity Z was ineffective. That is an XBRL instance fact (please click the image below):

The above example uses dimensional taxonomies in the segment to capture the controls hierarchy and use it for reporting. In this form, there will be as many contexts as there are controls, which may be too many for some tastes. Here is an alternative that also uses dimensional taxonomies, but in a different way (please click the image below):

In this version, there are only as many contexts as there are tests.

The important point to remember is that these tests of controls can be represented by XBRL instance documents, which is a powerful validation of the taxonomies that support them.