A control owner says a policy exists, so the control must be effective. What evidence is most appropriate?

1. Only the number of copies printed
2. Operating evidence and tests showing the intended behavior over the relevant scope
3. Only the author's job title
4. Only the policy's approval signature