CRISC - Domain 3: Risk Response and Reporting - Control Testing Methodologies