View source for Principle 12 - Implement Control Activities


12.01 Management should implement control activities through policies
and procedures.

Documentation of Control Activities Through Policies and Procedures 

12.02 Management establishes control activities by documenting in
policies what is expected and in procedures specified actions that
implement policies, to mitigate risks to achieving the entity’s
objectives to acceptable levels [documentation requirement].

12.03 Management documents in policies and procedures for each unit
within the entity’s organizational structure its responsibility for a
business process’s objectives and related risks and control activity
design, implementation, and operating effectiveness.102 Each unit, with
guidance from management, determines the policies necessary to operate
the business process based on the objectives and related risks. Each
unit also documents policies and procedures in the appropriate level of
detail to allow management to effectively monitor the control activity.
The documentation may appear in various forms, such as management
directives, administrative policies, or operating manuals.

12.04 Those in key roles for the unit may further define policies
through day-to-day procedures, depending on the rate of change in the
operating environment and complexity of the business process. Procedures
may include the timing of when a control activity occurs and any
follow-up corrective actions to be performed by competent personnel if
deficiencies are identified.103 Management communicates the policies and
procedures entity-wide so that personnel can implement the control
activities for their assigned responsibilities.

Periodic Review of Control Activities 

12.05 Management reviews policies, procedures, and related control
activities on a periodic and ongoing basis for continued relevance and
effectiveness in achieving the entity’s objectives or mitigating related
risks. If there is a significant change in an entity’s process,
management reviews this process in a timely manner after the change to
determine that the control activities are designed and implemented
appropriately. Changes may occur in personnel, business processes, or
information technology. A new law or regulation may change an entity’s
objectives or how an entity is to achieve an objective. Further, in the
federal environment, this may occur through government-wide policy or
guidance issued by entities like the Office of Management and Budget,
Office of Personnel Management, and the Department of the Treasury.
Management considers these changes in its periodic and ongoing reviews.
Management also considers the results of its monitoring activities to
determine whether control activities are designed and implemented
effectively.