Which of the following is the BEST method for assessing control effectiveness?