Policies and procedures designed to provide reasonable assurance that specific entity objectives will be achieved. It consists of: the control environment, risk assessment, control activities, information and communications, and monitoring.