An AMCR should be used whenever high risks are concentrated in certain component activities, the component risk is medium or low, previous control reviews identified no significant weaknesses, or verifying the correction of a previously reported weakness. An AMCR must be conducted for any component with an identified material weakness the year immediately following the completion of the planned corrective action to ensure that the problem was corrected. 2.4 Guidelines for Conducting Control Reviews. Control systems must be periodically reviewed to assure that Service responsibilities are being adequately met. The Division of Policy and Directives Management will provide detailed guidance and review instructions for conducting management control reviews annually.
Testing means verifying compliance with controls.
Appropriate testing of controls will determine whether reasonable assurance can be provided that the controls in place are working, whether they need to be improved, whether new ones need to be instituted, or whether overcontrol exists. Testing methods include document analysis, transaction analysis, observation, and interview. B. Quality Assurance. The Service must have a quality assurance process in place to make certain that management control systems are properly defined, that reviews are properly performed, and that the results of the reviews are accurately reported. Control systems consisting of event cycles, risks, control objectives, and controls should be in place for each component prior to review.