Policies, Standards, Controls, and Evidence

A commitment that is never converted into a tested control leaves nothing behind but the commitment.

On 19 December 2023 the Federal Trade Commission sued Rite Aid over its use of facial recognition in stores. Paragraph 5 of the complaint lists the absent controls one after another: “Among other things, Rite Aid failed to consider or address foreseeable harms to consumers flowing from its use of facial recognition technology, failed to test or assess the technology’s accuracy before or after deployment, failed to enforce image quality standards that were necessary for the technology to function accurately, and failed to take reasonable steps to train and oversee the employees charged with operating the technology in Rite Aid stores.”

Four alleged failures. Not one of them is a failure of the model.

The stipulated order for permanent injunction was entered on 26 February 2024. Provision I bans any Facial Recognition or Analysis System for five years. Provision III writes the missing control card into an enforceable obligation: a documented monitoring program, a designated responsible employee, and a written System Assessment at least once every twelve months. Read the ladder below against that case. The regulator had to supply, by order, the rungs the company never built.

Principle, policy, standard, procedure, control: each rung down the ladder turns something intended into something a reviewer can test. Only the bottom rung can be put on trial. And even there the trial splits in two. AS 2201 asks first whether the control was designed to do the job (¶.42). Then it asks whether the control actually ran, in the hands of someone with the authority and competence to run it (¶.44).

Governance works down a ladder. At the top is what an organization intends; at the bottom is what somebody actually does. Principles express values. Policies set mandatory direction. Standards define consistent requirements. Procedures describe work. Controls manage specific risks. Evidence shows whether the control operated.

A control gets ten fields. An objective, an owner, a trigger, a frequency. An input, a method, an expected result. Retained evidence, an exception path, a test procedure. The evidence has to correspond to the deployed version and context, not to a generic template.

Those fields are not a local invention. The GAO published the same idea as a catalogue in 2021, pairing every numbered key practice with questions to consider, audit procedures, and the types of evidence an auditor should collect.

The owner field is not administrative decoration. AS 2201 ¶.44 makes the person performing the control part of what is tested: does that person have the necessary authority and competence to perform it effectively. A blank there is not a formatting defect. It is the point at which the check stops binding anyone.

Ten fields sounds heavy until three product teams read the same fairness policy and none of them can name who owns the check.

Preventive controls reduce the chance of a failure. Detective controls find it. Corrective controls decide how bad it gets. The split is not a classroom scheme. It is standing public doctrine in two independent standards.

Timing is what separates the first pair. The GAO's Green Book, its standards for internal control in the federal government, sets it out: “Control activities can be either preventive or detective. The main difference between preventive and detective control activities is timing, that is, when the control activity occurs within an entity’s operations. A preventive control activity is designed to avoid an unintended event or result before it occurs. A detective control activity is designed to discover and timely correct an unintended event or result after it occurs.”

That definition has survived a rewrite. It stood at ¶10.04 of the 2014 edition. It stands at ¶10.10 of the revision published on 15 May 2025, effective from fiscal year 2026. Both editions ask for the two to be designed. Not one.

Financial reporting has the same pair, at AS 2201 ¶.A8: “Controls over financial reporting may be preventive controls or detective controls. Effective internal control over financial reporting often includes a combination of preventive and detective controls.” That second sentence is the portfolio argument in one line. Not a type. A combination.

The corrective work of the third column is already lodged inside the Green Book's detective definition, which asks the activity not merely to discover but to timely correct.

Three of the four drills below already have a published format you can copy. The fourth produces the uncomfortable total: how many controls exist on paper and cannot currently be tested at all.

The format is GAO-21-519SP, the accountability framework for AI published on 30 June 2021. It sorts four principles — governance, data, performance, monitoring — into 31 numbered key practices, running from 1.1 to 4.5. Its first page says what each practice carries: “Each practice includes a set of questions for entities, auditors, and third-party assessors to consider, along with audit procedures and types of evidence for auditors and third-party assessors to collect.” A practice got into that catalogue only when at least two independent sources called it important.

Every control here begins from a failure mechanism. A control designed from a policy sentence tends to protect the sentence.

The five steps below are not a private scheme. They are the order in which two published catalogues already work. The GAO framework moves from a numbered key practice, to the questions an entity, auditor or third-party assessor should consider, to audit procedures, to the types of evidence to collect. Objective, then operation, then record. AS 2201 tests the result in two passes that must not be collapsed: design effectiveness at ¶.42, operating effectiveness at ¶.44. And at ¶.46 the amount of evidence demanded is set by the risk attached to the control, not by the fact that the control exists.

Step 5 is where most control sets fail. It is the only step that can return a verdict the organisation did not want.

A control with no evidence that it ever operated is an intention. Auditors have a shorter word for it.

They also have a precise term for the other case, the control that was designed properly and quietly stopped running. The Green Book's 2025 revision fixes it at OV3.06: “A deficiency in operation exists when a properly designed control does not operate as designed”. That one sentence is why design and operation are tested separately. It is also why a well-drafted control card proves nothing on its own.

Decide in advance what a failed control test triggers: redesign, restrict, remedy, or retire. Rite Aid's order shows the outer end of that range. Provision I removed the technology for five years. Provision III specified what would have to exist before anything comparable could operate again.