a. Was the engagement team's assessment of the evaluation of the design of the controls appropriate (i.e., does the control identified by the team address the specific "what could go wrong" for each risk)? b. Was the team's interim and rollforward planned procedures to test the operating effectiveness of controls appropriate