Watch this video on YouTube
Which of the following is MOST important for a risk practitioner to verify when evaluating the effectiveness of an organization's existing controls?