Which of the following provides the MOST reliable evidence of a control's effectiveness?

A risk and control self-assessment relies on internal personnel's subjective evaluation, which, while useful, is not as objective or verifiable as automated testing.

Senior management's attestation is a statement of belief or confirmation, but it is not direct, objective evidence of a control's operational effectiveness.

A system-generated testing report provides empirical, objective evidence of a control's performance and effectiveness, based on actual operations or automated tests. This type of evidence is less subject to human bias or error compared to subjective assessments, attestations, or manual walk-throughs, making it the most reliable indicator of whether a control is operating as intended.

A detailed process walk-through can help understand how a control is designed to operate, but it does not provide consistent, verifiable data on its continuous effectiveness in the same way a system-generated report does.