• Are the controls explicit? Have they been identified and documented?
• Are they consistent across the business?
• Do they address the business critical success factors?
• Do the controls include risk management?
• What procedures need to be carried out to enable them to sign off that controls are effectively
working?