How do you test the effectiveness of PCI controls