What is the difference between control design, implementation and operating effectiveness?
Control design asks whether the control is capable of addressing the relevant risk. Implementation asks whether the control has been put into use. Operating effectiveness asks whether it operated as designed throughout the period or at the times on which the auditor intends to rely.
The distinctions matter because one conclusion does not prove the next. A policy may describe a well-designed review control, but the control is not implemented if nobody performs it. A control may be implemented at one point in time but operate inconsistently over the year.
The evidence also differs. Design may be assessed from the control description and how it addresses the risk. Implementation normally requires more than enquiry, such as inspection or observation. Operating effectiveness may involve inspection of multiple instances, reperformance, observation or other procedures depending on the nature and frequency of the control.
AI can keep these assessments separate, gather the relevant evidence and prepare a first-pass conclusion. The auditor should confirm that the evidence actually addresses the question being answered rather than allowing a document about design to stand in for proof of operation.
References: ISA 315 resources · PCAOB AS 2201