Know which controls we do not enforce

the second line, doing its job Risk, Compliance and Audit Evidence