Control effectiveness

A control that exists, one that operates and one that works are three different things.

The firewall is installed. The rules are actually being enforced. The rules actually stop what they were meant to stop. Audits frequently establish the first and report the third, which is how organisations end up genuinely surprised by an incident that a control they had was supposed to prevent.