What is the difference between a policy and a control?

In the ITIL framework, governance and management are distinct activities. The governing body is responsible for setting the organization's direction and intent through the creation of policies. These policies define the rules and requirements. Management is then responsible for planning, implementing, and operating the necessary controls to ensure that these policies are followed and that organizational objectives are met. Therefore, policies are an output of governance, while the definition and implementation of controls are a management activity.

A. This statement incorrectly reverses the relationship. Controls are mechanisms implemented to ensure adherence to policies, not the other way around.

B. This is incorrect. A control is a specific means of managing risk or ensuring a process is followed, whereas a policy is a broader statement of intent.

C. This is an inaccurate generalization. Policies can apply to technology (e.g., an information security policy), and controls can apply to people (e.g., segregation of duties).

1. AXELOS. (2020). ITIL® 4: Direct

Plan and Improve. TSO (The Stationery Office).

Section 4.3.1

Policies: "A policy is the formally documented expectations and intentions of the governing body... Policies are used to direct the actions and behaviours of the organization

its employees

and its partners." (p. 78)

Section 4.3.2

Controls: "Controls are the means for managing a risk

ensuring that a business objective is achieved

or that a process is followed... Controls are implemented by the organization’s management and staff to provide reasonable assurance that the organization will achieve its objectives." (p. 79)

Section 2.1.1

Governance: "The governing body is accountable for the organization’s performance and its compliance with policies and external regulations... It accomplishes this through an activity referred to as the evaluation of the organization’s performance

and by directing the organization through strategy and policies." (p. 12)