Control activities - policies and procedures

The entity deploys control activities through policies that establish expectations and procedures that put policies into action.

Trust Service Criterion

CC

Audit period

type-2

Points of focus

• Policies are approved and maintained
• Procedures describe control operation
• Policy exceptions are reviewed