Work as an IT auditor testing real ITGCs - change management, logical access, backups and segregation of duties. Each scenario runs the whole test end to end: find what is missing from the population you were handed, choose the sampling approach, test sampled tickets, leavers and logs item by item against the control as written, then weigh the deviation rate against the tolerable rate, decide whether a control fails and rate the finding.
The change manager has emailed you a tidy spreadsheet of 412 production changes. Before you sample a single ticket, work out what is missing from it - then plan the sample, test twelve tickets and decide what the results mean.
The service desk hands you its list of disabled accounts as the leavers population. Build the real population from HR and procurement, stratify for privileged users, test twelve leavers and decide what to do about logons after the leaving date.
Nightly backups, quarterly restore tests and an annual DR test. Separate design gaps from operating failures, size each test by how often the control runs, test a year of backup logs and rate what you find.
An ERP role extract, a conflict ruleset and a mitigating-control register. Find the toxic role combinations, test whether the mitigating review really works, choose how to quantify the exposure and rate the finding.