Controls have not been selected for testing when we are relying on Controls.
Solution: Where Controls Strategy is selected, each WCGW should be mitigated by a tested effective control (or combination of controls). Challenge the testing strategy for each of the controls associated to the WCGWs.
If each WCGW is not mitigated by a tested effective control (or combination of controls), then reconsider if the Controls Strategy is appropriate; also, challenge the control risk assessment for each relevant assertion associated to the WCGW.