# Control Design & Implementation, Execution & Effectiveness Testing: What's the Difference?

In the CERRIX platform, controls are a central component of your governance, risk, and compliance framework. Understanding the different types of control activities and testing phases is essential for effective risk mitigation and assurance.

This article explains the differences between **Control Design & Implementation Testing**, **Control Execution**, and **Control Effectiveness Testing**.

***

## Control Design & Implementation Testing

**Definition**:\
This is a test of the **suitability and proper setup** of the control. It determines whether the control, as designed and implemented, is capable of addressing the associated risk.

**Purpose**:\
To assess whether the control is appropriate and has been set up correctly within business processes or IT systems.

**Example**:\
Reviewing if a purchase approval workflow enforces segregation of duties between requester and approver.

**In CERRIX**:\
Documented in the **Control Library** or during **Control Assessment** workflows, often by second or third line teams (Compliance, Audit). Testing results are stored and linked to the control for transparency and auditability.

***

## Control Execution

**Definition**:\
Control execution refers to the **actual performance** of a control activity by the responsible party or system, according to its defined frequency and procedure.

**Purpose**:\
Ensure that the control is carried out as designed, on time, and by the appropriate stakeholder.

**Example**:\
A weekly review of user access logs performed by an IT administrator.

**In CERRIX**:\
Control execution is logged through the **Control Monitoring** module. Control owners receive automated tasks or notifications to perform and evidence control activities.

***

## Control Advanced Effectiveness Testing

**Definition**:\
This test checks whether the control **operates effectively over time**. It involves reviewing historical evidence to confirm that the control consistently works as intended.

**Purpose**:\
To validate that the control not only exists but also reliably mitigates the associated risk.

**Example**:\
Sampling the past 6 months of control executions to verify timely and complete access reviews were performed.

**In CERRIX**:\
Performed through the **Control Advanced Effectiveness Testing** feature, allowing testers to upload sampling results, attach evidence, and rate control performance (e.g., effective, partially effective, ineffective).

Learn more about Control Advanced Effectiveness Testing here:

{% content-ref url="/pages/7VNn92J8f6WTn0CzBHVI" %}
[Control Advanced Effectiveness Testing](/cerrix-functionalities/module-overview/controls/control-advanced-effectiveness-testing.md)
{% endcontent-ref %}

***

## Summary Table

| Activity                            | Focus Area              | Key Question                                              | Typical Role          |
| ----------------------------------- | ----------------------- | --------------------------------------------------------- | --------------------- |
| **Design & Implementation Testing** | Setup & Appropriateness | *Is the control well-designed and implemented correctly?* | Risk/Compliance/Audit |
| **Control Execution**               | Operational Delivery    | *Was the control performed as required?*                  | Control Owner         |
| **Effectiveness Testing**           | Performance Assurance   | *Is the control working reliably over time?*              | Compliance/Audit      |

***

## Best Practices

* Ensure roles and responsibilities are clearly defined in the **Control Owner** field in Cerrix.
* Use **automation** to schedule recurring control executions and reminders.
* Link testing activities to relevant risks, processes, and audits for traceability.
* Leverage **AI Assistance** in Cerrix to prefill control descriptions and suggest test procedures based on best practices.

***

**Need help setting up control workflows?**\
Contact support or your CERRIX Customer Success Manager for hands-on assistance.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.cerrix.com/best-practices-and-guides/control-design-and-implementation-execution-and-effectiveness-testing-whats-the-difference.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.