Reviewing controls
A useful control is performed, evidenced and connected to a clear risk.
Begin with the risk
Describe the error or misuse that the process needs to prevent or detect. Consider who can authorize, record and change a transaction. This makes the control objective concrete enough to test.
Observe the practice
Ask the process owner to demonstrate a recent instance. Look for evidence, exception handling and the timing of the check. A written policy and an operating control are related, but they are not the same thing.
Keep the change practical
Where a gap exists, design a response that fits the organization and its systems. Assign ownership and a review date. A smaller reliable check can be more useful than an elaborate process nobody can maintain.