Determine if there is a program to train employees who usesystems about the security methods and controls in place. Training should be documented in either a training log or the employees personnel file. Ask employees who use systems about their knowledge of security methods.