If the Business Unit has inherent control weaknesses, that is some risks do not have a sufficiently robust control environment to provide suitable risk mitigation – they have been assigned say a “C” or “D” in the matrix, it may be decided that Substantive Testing is required to establish whether or not the risk in question has actually occurred. The details of the test(s) to be conducted are entered at the Risk Screen level (see above); this report prints details of all such tests designed for the Entity:
