That those controls are working as specified The process takes three to six months to complete and begins with each asset completing a self-assessment against criteria set by internal and external experts.