In the context of CCB certification, what is the most important consideration when implementing operational risk & control testing?