A North American manufacturer struggled with meeting an executive mandate for quarterly IT controls testing in a financially responsible manner. Its solution was to categorize IT controls based on business impact and use the categorizations to set IT controls testing scope and frequency. This allowed the manufacturer to increase testing frequency without having to test 100% of the IT controls every quarter.