A control is a rule for your organization.
- For example: A new hire background screening is required as a component of employee provisioning.
A test is what the auditor is looking for.
- For example: Evidence of a background screening performed for a recently hired employee.