[Verse 1] Five broken statements lying on the page Missing pieces, causing management rage Who should do it, what's the task at hand When and how often, conditions to understand Let's rebuild them, make them crystal clear Actor, action, object, frequency here [Chorus] A-A-O-F-C, elements we need to see Actor does the action, object's what they check Frequency tells us when, conditions we expect A-A-O-F-C, rewrite them perfectly Control statements that actually protect [Verse 2] Statement one says "passwords must be strong" But who enforces this, something's going wrong IT security team, that's our actor now Reviews user passwords, action we allow Monthly audits happen, frequency is set When accounts are created, condition we won't forget [Chorus] A-A-O-F-C, elements we need to see Actor does the action, object's what they check Frequency tells us when, conditions we expect A-A-O-F-C, rewrite them perfectly Control statements that actually protect [Verse 3] "Financial records should be accurate" Vague and useless, let's elaborate Finance manager validates the books Monthly reconciliation, second look Before month-end closing, timing is key Now we have clarity for all to see [Bridge] From fuzzy words to crystal clear Every element must appear Who does what and to what thing When they do it, conditions bring Transform the weak into the strong Controls that work and last so long [Chorus] A-A-O-F-C, elements we need to see Actor does the action, object's what they check Frequency tells us when, conditions we expect A-A-O-F-C, rewrite them perfectly Control statements that actually protect [Verse 4] Three more statements need our helping hand "Data backup should be planned" "Access rights require review" "Vendor payments must be due" Each one missing crucial parts Let's rebuild with beating hearts [Outro] Five statements fixed, elements complete Actor, action, make controls concrete Object, frequency, condition too Management controls that see us through A-A-O-F-C, the formula's the key Perfect control statements, finally free
← Exercise 3: Framework Mapping | Exercise 5: Compensating Control Design →