The BEST way for management to validate whether risk response activities have been completed is to review:

The risk register change log is an audit trail that documents all modifications to the risk register, including the status of risk response activities, control implementation dates, and ownership changes. By reviewing this log, management can verify that planned risk responses have been initiated, updated, and completed as intended.

Evidence of risk acceptance indicates a decision to tolerate a risk, not that risk response activities to mitigate or transfer a risk have been completed.

Control effectiveness test results validate if a control is working as intended, which is important, but the change log provides broader evidence of the completion of the entire response activity itself, including non-control related responses.

Control design documentation outlines how a control should work, but it does not confirm if the control has been implemented or if the risk response activity has been completed.