Evaluating Controls with Compliance Testing