Audit and compliance
in the real world.

Test whether controls work, who owns the risk and whether changes and suppliers are properly reviewed.