[Verse 1] Every control needs a blueprint clear Document the design before you steer What's the objective we're trying to reach? Define the goal that we want to achieve Who will own it, who's in command? Responsibility must be in someone's hand [Chorus] Design it, Own it, Measure, Operate Four pillars strong, don't hesitate Document the plan, make it concrete Objective, Owner, Frequency, Receipt Design it, Own it, Measure, Operate Control foundations we must create [Verse 2] How often will this control run its course? Weekly, monthly, define the source Daily checks or annual reviews Frequency matters, you get to choose But document it, make it known So the rhythm's clearly shown [Chorus] Design it, Own it, Measure, Operate Four pillars strong, don't hesitate Document the plan, make it concrete Objective, Owner, Frequency, Receipt Design it, Own it, Measure, Operate Control foundations we must create [Bridge] Evidence of performance, proof of the deed Show that the control is meeting the need Measurable criteria, how do we know? Track the effectiveness, watch how it grows From design to implementation's call Documentation covers it all [Verse 3] Policy states what we must include Every control needs this attitude Specified design with clear intent Responsible party, time well spent Frequency planned and evidence traced Management controls are properly placed [Chorus] Design it, Own it, Measure, Operate Four pillars strong, don't hesitate Document the plan, make it concrete Objective, Owner, Frequency, Receipt Design it, Own it, Measure, Operate Control foundations we must create [Outro] When controls are designed with purpose true Implementation follows through Four elements strong, the framework's set Management controls without regret
← 3 Cross-Referencing Between Documents | 2 Monitoring and Testing →