How do I build a repeatable internal controls testing checklist for pre-deployment security validation in user acceptance testing (UAT)?

How do I build a repeatable internal controls testing checklist for pre-deployment security validation in user acceptance testing (UAT)?