A signed policy is not proof the control operated
Walkthroughs that stop at design leave operating effectiveness as an annual surprise.
Teams under deadline often treat a policy update as the finish line. Months later, sample testing shows approvals skipped, secondary reviews rubber-stamped, or reconciliations prepared after the books already closed.
Separate design questions from operation questions on day one. Who should perform the control, and who actually did? What artefact would convince a sceptical reviewer without a side conversation?
In an Internal Control Review we spend early days on the evidence path, not on polishing flowcharts that nobody can re-perform.