We work on controls testing. Majorly to provide assurance on the level of risk the controls are mitigating: general it controls as well as business control