Note
Governance theatre
A control that exists only to be shown to an auditor is not a control. It is a costume.
The test I keep coming back to: would this control still run, in the same way, if no one outside the team ever asked to see it? If the honest answer is no, it isn't protecting the organisation.. it is protecting the appearance of the organisation, which is a different job entirely, and a more dangerous one, because it's easy to mistake for the real thing. Very easy. Another problem.
Personal reflection. Views are my own and not those of my employer.