Victoria shares that security requirements are written at the high level. There should be no short of ways to implement the controls. We can't test all the implementations.