Control effectiveness is best determined throughcontrol testing, which evaluates whether a control operates as intended over time. It includes functional and operational validation under real-world conditions, unlike documentation or design, which only indicate intent.