It's not just about controls, but, control description - control implementation - control effectiveness / delivered or not.