Periodically testing that controls operate as designed, selecting samples, recording results, tracking remediation of failures, and reassessing whether each control remains relevant as the business and regulation change.