Plan control tests, record evidence, log findings, and assign remediation. See which controls were tested, which failed, and which findings are still open.