Operate and test

Work through due controls and record evidence

Test a control and get it signed off

Manage deficiencies, exceptions and risk acceptance

Connect reporting systems and monitor reporting health