Policies, Procedures, and Internal Controls
What the domain tests
Policies state principles and requirements; procedures describe how work is done; controls are the mechanisms that prevent, detect, or correct failures. Candidates must understand the control environment, control types (preventive, detective, corrective; manual and automated; entity-level and transaction-level), and the control lifecycle from design through operating effectiveness testing.
Concepts to master
Policy hierarchy and governance, including who approves, how often policies are reviewed, and how exceptions are documented and approved. Version control, attestation, and communication. Segregation of duties and maker-checker controls. Key control identification and the distinction between a key control and a compensating control. Root cause analysis when a control fails. Understand that a policy without an enforcing control is aspirational, and a control without a documented procedure is fragile.
Traps
Questions often present a policy that exists but is not followed, testing whether you recognize a control design versus operating failure. Another trap is accepting an exception approval from someone without authority. Watch for answers that add a new policy when the real gap is a missing control or unclear procedure. Also be alert to automated controls: they still require testing of configuration and change management.
Worked example
An expense approval policy requires manager sign-off above a threshold. Testing finds approvals granted by the submitter in 12 of 100 samples. The finding is an operating effectiveness failure in segregation of duties, not a policy design flaw. The remedy is to enforce system-level role restrictions, retrain, and retest, not to rewrite the policy. Rule of thumb: fix the control, then the training, then the wording.
Exam focus
Expect questions on control classification, exception handling, and policy review cycles.