Principle 12 - Implement Control Activities - Revision history

Kelly at 22:09, 13 August 2026

2026-08-13T22:09:43Z

← Older revision		Revision as of 22:09, 13 August 2026
Line 21:		Line 21:

	==== '''12.05''' ====		==== '''12.05''' ====
	Management reviews policies, procedures, and related control activities on a periodic and ongoing basis for continued relevance and effectiveness in achieving the entity’s objectives or mitigating related risks. If there is a significant change in an entity’s process, management reviews this process in a timely manner after the change to determine that the control activities are designed and implemented appropriately. Changes may occur in personnel, business processes, or information technology. A new law or regulation may change an entity’s objectives or how an entity is to achieve an objective. Further, in the federal environment, this may occur through government-wide policy or guidance issued by entities like the Office of Management and Budget, Office of Personnel Management, and the Department of the Treasury. Management considers these changes in its periodic and ongoing reviews. Management also considers the results of its monitoring activities to determine whether control activities are designed and implemented effectively.{{Principles}}		Management reviews policies, procedures, and related control activities on a periodic and ongoing basis for continued relevance and effectiveness in achieving the entity’s objectives or mitigating related risks. If there is a significant change in an entity’s process, management reviews this process in a timely manner after the change to determine that the control activities are designed and implemented appropriately. Changes may occur in personnel, business processes, or information technology. A new law or regulation may change an entity’s objectives or how an entity is to achieve an objective. Further, in the federal environment, this may occur through government-wide policy or guidance issued by entities like the Office of Management and Budget, Office of Personnel Management, and the Department of the Treasury. Management considers these changes in its periodic and ongoing reviews. Management also considers the results of its monitoring activities to determine whether control activities are designed and implemented effectively.

			{{Principles}}

	== Related Story Events ==		== Related Story Events ==

Kelly at 22:09, 13 August 2026

2026-08-13T22:09:18Z

← Older revision		Revision as of 22:09, 13 August 2026
Line 1:		Line 1:
	== 12.0 Implement Control Activities ==		== 12.0 Implement Control Activities ==
	'''12.01 Management should implement control activities through policies and procedures.~~'''~~		[https://guides.gaoinnovations.gov/greenbook/2025/principle-12-implement-control-activities/ External Link to US GAO Green Book Principle 12]

			=== Overview ===

			==== '''12.01''' ====
			Management should implement control activities through policies and procedures.

	=== 12.1 Documentation of Control Activities Through Policies and Procedures ===		=== 12.1 Documentation of Control Activities Through Policies and Procedures ===
	'''12.02 Management establishes control activities by documenting in policies what is expected and in procedures specified actions that implement policies, to mitigate risks to achieving the entity’s objectives to acceptable levels [documentation requirement].'''

	'''12.03 Management documents in policies and procedures for each unit within the entity’s organizational structure its responsibility for a business process’s objectives and related risks and control activity design, implementation, and operating effectiveness.~~'''~~ Each unit, with guidance from management, determines the policies necessary to operate the business process based on the objectives and related risks. Each unit also documents policies and procedures in the appropriate level of detail to allow management to effectively monitor the control activity. The documentation may appear in various forms, such as management directives, administrative policies, or operating manuals.		==== '''12.02''' ====
			Management establishes control activities by documenting in policies what is expected and in procedures specified actions that implement policies, to mitigate risks to achieving the entity’s objectives to acceptable levels '''[documentation requirement].'''

			==== '''12.03''' ====
			Management documents in policies and procedures for each unit within the entity’s organizational structure its responsibility for a business process’s objectives and related risks and control activity design, implementation, and operating effectiveness. Each unit, with guidance from management, determines the policies necessary to operate the business process based on the objectives and related risks. Each unit also documents policies and procedures in the appropriate level of detail to allow management to effectively monitor the control activity. The documentation may appear in various forms, such as management directives, administrative policies, or operating manuals.

	'''12.04 Those in key roles for the unit may further define policies through day-to-day procedures, depending on the rate of change in the operating environment and complexity of the business process.~~'''~~ Procedures may include the timing of when a control activity occurs and any follow-up corrective actions to be performed by competent personnel if deficiencies are identified. Management communicates the policies and procedures entity-wide so that personnel can implement the control activities for their assigned responsibilities.		==== '''12.04''' ====
			Those in key roles for the unit may further define policies through day-to-day procedures, depending on the rate of change in the operating environment and complexity of the business process. Procedures may include the timing of when a control activity occurs and any follow-up corrective actions to be performed by competent personnel if deficiencies are identified. Management communicates the policies and procedures entity-wide so that personnel can implement the control activities for their assigned responsibilities.

	=== 12.2 Periodic Review of Control Activities ===		=== 12.2 Periodic Review of Control Activities ===

	'''12.05 Management reviews policies, procedures, and related control activities on a periodic and ongoing basis for continued relevance and effectiveness in achieving the entity’s objectives or mitigating related risks.~~'''~~ If there is a significant change in an entity’s process, management reviews this process in a timely manner after the change to determine that the control activities are designed and implemented appropriately. Changes may occur in personnel, business processes, or information technology. A new law or regulation may change an entity’s objectives or how an entity is to achieve an objective. Further, in the federal environment, this may occur through government-wide policy or guidance issued by entities like the Office of Management and Budget, Office of Personnel Management, and the Department of the Treasury. Management considers these changes in its periodic and ongoing reviews. Management also considers the results of its monitoring activities to determine whether control activities are designed and implemented effectively.{{Principles}}		==== '''12.05''' ====
			Management reviews policies, procedures, and related control activities on a periodic and ongoing basis for continued relevance and effectiveness in achieving the entity’s objectives or mitigating related risks. If there is a significant change in an entity’s process, management reviews this process in a timely manner after the change to determine that the control activities are designed and implemented appropriately. Changes may occur in personnel, business processes, or information technology. A new law or regulation may change an entity’s objectives or how an entity is to achieve an objective. Further, in the federal environment, this may occur through government-wide policy or guidance issued by entities like the Office of Management and Budget, Office of Personnel Management, and the Department of the Treasury. Management considers these changes in its periodic and ongoing reviews. Management also considers the results of its monitoring activities to determine whether control activities are designed and implemented effectively.{{Principles}}

	== Related Story Events ==		== Related Story Events ==

Kelly at 04:34, 6 August 2026

2026-08-06T04:34:17Z

← Older revision		Revision as of 04:34, 6 August 2026
Line 3:		Line 3:

	=== 12.1 Documentation of Control Activities Through Policies and Procedures ===		=== 12.1 Documentation of Control Activities Through Policies and Procedures ===
	12.02 Management establishes control activities by documenting in policies what is expected and in procedures specified actions that implement policies, to mitigate risks to achieving the entity’s objectives to acceptable levels [documentation requirement].		'''12.02 Management establishes control activities by documenting in policies what is expected and in procedures specified actions that implement policies, to mitigate risks to achieving the entity’s objectives to acceptable levels [documentation requirement].'''

	12.03 Management documents in policies and procedures for each unit within the entity’s organizational structure its responsibility for a business process’s objectives and related risks and control activity design, implementation, and operating effectiveness.~~102~~ Each unit, with guidance from management, determines the policies necessary to operate the business process based on the objectives and related risks. Each unit also documents policies and procedures in the appropriate level of detail to allow management to effectively monitor the control activity. The documentation may appear in various forms, such as management directives, administrative policies, or operating manuals.		'''12.03 Management documents in policies and procedures for each unit within the entity’s organizational structure its responsibility for a business process’s objectives and related risks and control activity design, implementation, and operating effectiveness.''' Each unit, with guidance from management, determines the policies necessary to operate the business process based on the objectives and related risks. Each unit also documents policies and procedures in the appropriate level of detail to allow management to effectively monitor the control activity. The documentation may appear in various forms, such as management directives, administrative policies, or operating manuals.

	12.04 Those in key roles for the unit may further define policies through day-to-day procedures, depending on the rate of change in the operating environment and complexity of the business process. Procedures may include the timing of when a control activity occurs and any follow-up corrective actions to be performed by competent personnel if deficiencies are identified.~~103~~ Management communicates the policies and procedures entity-wide so that personnel can implement the control activities for their assigned responsibilities.		'''12.04 Those in key roles for the unit may further define policies through day-to-day procedures, depending on the rate of change in the operating environment and complexity of the business process.''' Procedures may include the timing of when a control activity occurs and any follow-up corrective actions to be performed by competent personnel if deficiencies are identified. Management communicates the policies and procedures entity-wide so that personnel can implement the control activities for their assigned responsibilities.

	Periodic Review of Control Activities		=== 12.2 Periodic Review of Control Activities ===

	12.05 Management reviews policies, procedures, and related control activities on a periodic and ongoing basis for continued relevance and effectiveness in achieving the entity’s objectives or mitigating related risks. If there is a significant change in an entity’s process, management reviews this process in a timely manner after the change to determine that the control activities are designed and implemented appropriately. Changes may occur in personnel, business processes, or information technology. A new law or regulation may change an entity’s objectives or how an entity is to achieve an objective. Further, in the federal environment, this may occur through government-wide policy or guidance issued by entities like the Office of Management and Budget, Office of Personnel Management, and the Department of the Treasury. Management considers these changes in its periodic and ongoing reviews. Management also considers the results of its monitoring activities to determine whether control activities are designed and implemented effectively.{{Principles}}		'''12.05 Management reviews policies, procedures, and related control activities on a periodic and ongoing basis for continued relevance and effectiveness in achieving the entity’s objectives or mitigating related risks.''' If there is a significant change in an entity’s process, management reviews this process in a timely manner after the change to determine that the control activities are designed and implemented appropriately. Changes may occur in personnel, business processes, or information technology. A new law or regulation may change an entity’s objectives or how an entity is to achieve an objective. Further, in the federal environment, this may occur through government-wide policy or guidance issued by entities like the Office of Management and Budget, Office of Personnel Management, and the Department of the Treasury. Management considers these changes in its periodic and ongoing reviews. Management also considers the results of its monitoring activities to determine whether control activities are designed and implemented effectively.{{Principles}}

	== Related Story Events ==		== Related Story Events ==

Kelly at 04:32, 6 August 2026

2026-08-06T04:32:21Z

@@ Line 1: / Line 1: @@
-.01 Management should implement control activities through policies
+=== 12.1 Documentation of Control Activities Through Policies and Procedures ===
-and procedures.
+.02 Management establishes control activities by documenting in policies what is expected and in procedures specified actions that implement policies, to mitigate risks to achieving the entity’s objectives to acceptable levels [documentation requirement].
-Documentation of Control Activities Through Policies and Procedures
+.03 Management documents in policies and procedures for each unit within the entity’s organizational structure its responsibility for a business process’s objectives and related risks and control activity design, implementation, and operating effectiveness.102 Each unit, with guidance from management, determines the policies necessary to operate the business process based on the objectives and related risks. Each unit also documents policies and procedures in the appropriate level of detail to allow management to effectively monitor the control activity. The documentation may appear in various forms, such as management directives, administrative policies, or operating manuals.
-.02 Management establishes control activities by documenting in
+.04 Those in key roles for the unit may further define policies through day-to-day procedures, depending on the rate of change in the operating environment and complexity of the business process. Procedures may include the timing of when a control activity occurs and any follow-up corrective actions to be performed by competent personnel if deficiencies are identified.103 Management communicates the policies and procedures entity-wide so that personnel can implement the control activities for their assigned responsibilities.
-.03 Management documents in policies and procedures for each unit
+Periodic Review of Control Activities
-.04 Those in key roles for the unit may further define policies
+.05 Management reviews policies, procedures, and related control activities on a periodic and ongoing basis for continued relevance and effectiveness in achieving the entity’s objectives or mitigating related risks. If there is a significant change in an entity’s process, management reviews this process in a timely manner after the change to determine that the control activities are designed and implemented appropriately. Changes may occur in personnel, business processes, or information technology. A new law or regulation may change an entity’s objectives or how an entity is to achieve an objective. Further, in the federal environment, this may occur through government-wide policy or guidance issued by entities like the Office of Management and Budget, Office of Personnel Management, and the Department of the Treasury. Management considers these changes in its periodic and ongoing reviews. Management also considers the results of its monitoring activities to determine whether control activities are designed and implemented effectively.{{Principles}}
 == Related Story Events ==

Kelly at 04:30, 6 August 2026

2026-08-06T04:30:53Z

@@ Line 48: / Line 48: @@
 determine whether control activities are designed and implemented
 effectively.
 == Related Story Events ==
@@ Line 53: / Line 55: @@
 * [[2020: The Event|🗳️ 2020: The Event]]
 * [[December 2024: Gaining Support|📋 December 2024: Gaining Support]]

Kelly: Added cross-links to story events

2026-08-03T23:52:50Z

Added cross-links to story events

← Older revision		Revision as of 23:52, 3 August 2026
Line 48:		Line 48:
	determine whether control activities are designed and implemented		determine whether control activities are designed and implemented
	effectively.		effectively.

			== Related Story Events ==

			* [[2020: The Event\|🗳️ 2020: The Event]]
			* [[December 2024: Gaining Support\|📋 December 2024: Gaining Support]]

			== Navigation ==

			{\| class="wikitable" style="width: 100%;"
			! colspan="3" \| Quick Navigation
			\|-
			\| style="width: 33%; text-align: center;" \| [[Main Page\|🏠 Main Page]]
			\| style="width: 33%; text-align: center;" \| [[The Story\|📖 The Story]]
			\| style="width: 33%; text-align: center;" \| [[Governance Analysis\|📊 Governance Analysis]]
			\|}

Kelly: Auto-created by CAP AZ bot

2026-08-03T23:49:34Z

Auto-created by CAP AZ bot

New page

12.01 Management should implement control activities through policies
and procedures.

Documentation of Control Activities Through Policies and Procedures

12.02 Management establishes control activities by documenting in
policies what is expected and in procedures specified actions that
implement policies, to mitigate risks to achieving the entity’s
objectives to acceptable levels [documentation requirement].

12.03 Management documents in policies and procedures for each unit
within the entity’s organizational structure its responsibility for a
business process’s objectives and related risks and control activity
design, implementation, and operating effectiveness.102 Each unit, with
guidance from management, determines the policies necessary to operate
the business process based on the objectives and related risks. Each
unit also documents policies and procedures in the appropriate level of
detail to allow management to effectively monitor the control activity.
The documentation may appear in various forms, such as management
directives, administrative policies, or operating manuals.

12.04 Those in key roles for the unit may further define policies
through day-to-day procedures, depending on the rate of change in the
operating environment and complexity of the business process. Procedures
may include the timing of when a control activity occurs and any
follow-up corrective actions to be performed by competent personnel if
deficiencies are identified.103 Management communicates the policies and
procedures entity-wide so that personnel can implement the control
activities for their assigned responsibilities.

Periodic Review of Control Activities

12.05 Management reviews policies, procedures, and related control
activities on a periodic and ongoing basis for continued relevance and
effectiveness in achieving the entity’s objectives or mitigating related
risks. If there is a significant change in an entity’s process,
management reviews this process in a timely manner after the change to
determine that the control activities are designed and implemented
appropriately. Changes may occur in personnel, business processes, or
information technology. A new law or regulation may change an entity’s
objectives or how an entity is to achieve an objective. Further, in the
federal environment, this may occur through government-wide policy or
guidance issued by entities like the Office of Management and Budget,
Office of Personnel Management, and the Department of the Treasury.
Management considers these changes in its periodic and ongoing reviews.
Management also considers the results of its monitoring activities to
determine whether control activities are designed and implemented
effectively.