Reperformance

What Reperformance Proves in an Audit

Reperformance is strongest when the reviewer does not just inspect evidence but independently recreates the control outcome. That makes it a verification method, not a documentation review. In practice, it answers a simple question: would the control still produce the claimed result if someone else carried it out again?

Why Reperformance Is So Evidentially Strong

Reperformance is valued because it tests the control at the point of execution. If a reviewer can repeat the process and get the same result, the organisation’s narrative is more credible. If they cannot, the gap may be in design, execution, data quality, timing, or the way the control was described.

This is why reperformance often carries more weight than walkthroughs, screenshots, or attestations alone. It reduces reliance on self-reporting and helps distinguish a control that exists on paper from one that actually works under real conditions.

Where Reperformance Is Used Most Often

Reperformance appears frequently in internal audit, external audit, compliance testing, and control validation. Common examples include recalculating a sample-based metric, repeating an access review step, or attempting a revoked authentication path to confirm that access was actually removed. The same approach also applies to reconciliations, approvals, exception handling, and other controls whose output can be independently recreated.

Its usefulness depends on whether the control outcome is observable and repeatable. If the result can only be inferred indirectly, reperformance may be less effective than inspection or substantive testing. But when the control produces a measurable outcome, reperformance is one of the clearest ways to test whether the control is real.

What Makes Reperformance Different from Other Audit Tests

Reperformance differs from inquiry because it does not depend on what people say they did. It differs from inspection because it does not stop at reviewing artefacts. It also differs from observation because the reviewer is actively reproducing the control outcome rather than watching someone else perform it.

That difference matters in controls that are easy to describe but harder to execute reliably. A control may appear sound in policy language yet fail when timing, permissions, data inputs, or system state change. Reperformance exposes those failures by making the reviewer prove the result, not just the process.

Risk and Threat Considerations

Reperformance matters because weak controls often fail quietly. If an organisation only reviews evidence of completion, it may miss stale access, broken revocation, incorrect calculations, or controls that no longer produce the intended security outcome.

Failure mechanism: The control looks effective in records, but the real-world action was incomplete, misapplied, or reversible, so the claimed outcome cannot be trusted.

Impact: False assurance can leave inappropriate access in place, mask control drift, and delay detection of compromise, governance failure, or audit exceptions.

Practitioner Guidance

Why practitioners should care: Reperformance is most useful when the control’s outcome can be reproduced independently and the cost of being wrong is material. It is especially valuable where access, entitlement, or completion claims affect security assurance.

What to watch for: If the control depends on manual judgement, unstable data, or system states that change quickly, define the exact point in time and input set to be repeated. Otherwise the test can produce a mismatch that reflects timing drift rather than a true control failure.

Practitioner takeaway: Use reperformance to validate outcomes, not just procedures, and treat unexpected mismatch as a signal to investigate both control execution and the evidence trail.

Related resources from NHI Mgmt Group

• Control Reperformance
• Auditor reperformance