On the utility of backtesting operational risk controls

I'm still trying to get my head around practical ways to really stress-test operational risk frameworks, beyond just incident reviews. We document controls and perform walkthroughs, sure, but how do you effectively 'backtest' them? Meaning, trying to proactively identify weaknesses before they lead to losses, similar to how market risk models are backtested. Are there specific simulation techniques or quantitative methods anyone here has found genuinely useful for this, or is it mostly just a qualitative exercise?