(9)To guarantee the effectiveness of the control and safeguard arrangements for information processing systems, external reviewers should implement a control framework for ICT risk management that includes IT and information security assessments and the testing of backup ICT systems to ensure business continuity.