Test of design (TOD) and test of operating effectiveness (TOE) are the two main ways auditors evaluate a control. A test of design checks whether the control, as described, could prevent or detect the risk it is meant to address. A test of operating effectiveness checks whether the control actually ran as designed during the period under review.
In a SOC 2 examination, both kinds of testing matter, but they answer different questions. Type 1 reports emphasize design at a point in time. Type 2 reports also test operating effectiveness over an audit period.
In simple terms, TOD and TOE answer:
- Is this control designed in a way that could work?
- Did the control actually operate when it was supposed to?
- What evidence supports each conclusion?
Why TOD and TOE Matter
Auditors do not only read your policies. They test whether your controls are capable of working and whether they worked in practice.
TOD and TOE matter because:
- A well designed control that never runs still leaves risk unaddressed.
- A control that ran often but was poorly designed may not reduce the risk you think it does.
- SOC 2 Type 1 and SOC 2 Type 2 examinations put different weight on each type of test.
- Findings often distinguish design issues from operating issues, which changes the remediation path.
Test of Design Explained
A test of design evaluates the control description, the related procedures, and the supporting configuration or process. The auditor asks whether the control, if operated as described, would meet the relevant criteria.
Common design testing activities include:
- Reading the control wording in your system description and policies
- Walking through the process with the control owner
- Inspecting configuration settings that enforce the control
- Checking whether the control has a clear trigger, owner, and expected outcome
Design testing is usually done with inquiry, observation, and inspection. It can often be completed with a small number of walkthroughs rather than a large sample.
Test of Operating Effectiveness Explained
A test of operating effectiveness evaluates whether the control ran as designed during the period. The auditor selects items from a population and looks for audit evidence that the control operated for those items.
Common operating effectiveness testing activities include:
- Selecting an audit sample from the period
- Tracing each sample to approvals, tickets, logs, or screenshots
- Checking dates, owners, and required steps
- Recording exceptions when the control did not operate as described
Operating effectiveness testing depends on a complete population and durable evidence. If evidence was never retained, the control may fail the test even if people believe it ran.
TOD vs TOE at a Glance
| Aspect | Test of design (TOD) | Test of operating effectiveness (TOE) |
|---|---|---|
| Core question | Could this control work as described? | Did this control run as designed? |
| Typical timing | Point in time, often early in fieldwork | Across the audit period |
| Evidence focus | Descriptions, walkthroughs, configurations | Samples, dated records, approvals, logs |
| Common in | Type 1 and Type 2 | Primarily Type 2 |
| Typical failure | Missing owner, weak design, no enforcement | Missed approvals, incomplete samples, gaps in the period |
Examples by Control Area
| Control area | Design focus | Operating effectiveness focus |
|---|---|---|
| Change management | Is peer review required before production deploys? | Did sampled changes show review and approval before deploy? |
| Logical access | Is access provisioned through an approved request? | Did sampled new accounts have approved requests and timely removal on exit? |
| User access review | Is a periodic review defined for in-scope systems? | Were reviews completed on schedule with documented decisions? |
| Incident management | Is there a defined triage and escalation process? | Do sampled incidents show timely response and closure records? |
How Design and Operating Issues Differ
A design deficiency means the control, even if followed perfectly, may not achieve its objective. Fixing it usually means changing the process, adding automation, or rewriting the control.
An operating deficiency means the control design is sound, but people or systems did not follow it consistently. Fixing it usually means better monitoring, clearer ownership, training, or remediation of missed instances through exception management.
Auditors may also evaluate the severity of exceptions. One missed approval in a large sample is different from a pattern of missed approvals across the period. Ask your auditor how they classify findings rather than assuming.
Evidence Teams Commonly Prepare
For design testing:
- Current control descriptions and policies
- Diagrams or written walkthroughs of the process
- Screenshots of enforcing configurations
- Named control owners and escalation paths
For operating effectiveness testing:
- Populations for the audit period
- Sample support packages with dated evidence
- Approval records, tickets, pull requests, and logs
- Exception logs and corrective action records
For deeper guidance on sampling and period evidence, see What Is an Audit Sample? and What Is an Audit Period?.
Common Mistakes
- Treating a written policy as proof the control operated
- Collecting screenshots only at year end instead of retaining evidence over time
- Rebuilding populations after removing items that look like failures
- Confusing a Type 1 design-focused report with Type 2 period testing
- Assuming a compensating control covers a design gap without documenting why
How AuditFlo.co Helps
AuditFlo.co helps teams retain continuous evidence collection and audit-period history for operational artifacts when those records are stored or linked through connected systems and workflows your team already uses, such as GitHub and Jira.
That history can make it easier to support operating effectiveness testing with dated records. AuditFlo.co does not design your controls, does not perform TOD or TOE testing, does not issue SOC 2 reports, does not certify compliance, and does not replace auditors.
To see the workflow for your stack, request a demo.
Key Takeaway
Test of design asks whether a control could work. Test of operating effectiveness asks whether it did work during the period. Know which question your auditor is answering, keep design documentation current, and retain dated evidence so samples are ready when fieldwork starts.