Quick question for software developers and auditors

[king_pellinor]

I've just been asked to verify that two controls over the security of an application we use are operating effectively.

One control is that we restrict developer access to particular people, and the other is that we ensure that the list of people permitted to access it through a certain security portal has been updated properly.

The application is developed by a third party, and we have no developer access at all.  Also, we don't use that security system, as  it's designed for mainframes and we work on Windows.

So as the two controls are utterly irrelevant to the application, are they "operating effectively" or not?

I'm threatened with "further action" if I get this wrong...