Requirement
The entity deploys control activities through policies that establish what is expected and in procedures that put policies into action.
Points of Focus
Establishes Policies and Procedures to Support Deployment of Management’s Directives
Requirement: Management establishes control activities that are built into business processes and employees’ day-to-day activities through policies establishing what is expected and relevant procedures specifying actions.
Establishes Responsibility and Accountability for Executing Policies and Procedures
Requirement: Management establishes responsibility and accountability for control activities with management (or other designated personnel) of the business unit or function in which the relevant risks reside.
Performs in a Timely Manner
Requirement: Responsible personnel perform control activities in a timely manner as defined by the policies and procedures.
Takes Corrective Action
Requirement: Responsible personnel investigate and act on matters identified as a result of executing control activities.
Performs Using Competent Personnel
Requirement: Competent personnel with sufficient authority perform control activities with diligence and continuing focus.
Reassesses Policies and Procedures
Requirement: Management periodically reviews control activities to determine their continued relevance and refreshes them when necessary.
Explanation
Controls only operate reliably when they are written into policies that say what is expected and procedures that say how to do it, with named owners, timely execution, competent staff, and follow-up on issues found. Auditors check that policies exist, are assigned, are followed in practice, and are periodically reviewed.
