[Verse 1]
A control without a policy standing alone
Is just ad hoc, with no direction shown
Random actions, no clear reasoning why
Without foundation, it's destined to die
A policy without controls to make it real
Is aspirational, just an ideal
Pretty words that sound so very nice
But no way to verify or check the price
[Chorus]
Policy says what, controls say how
Symbiotic partners working right now
Trace every control back to policy ground
Make sure every policy has controls to be found
What and how, dancing together
Building trust that lasts forever
[Verse 2]
Policies define what we commit to do
The promises we make, our values true
But commitments need operationalization
Controls provide the verification
Every single control should trace its way
Back to policy statements that we obey
And every policy needs supporting force
Controls that keep it right on course
[Chorus]
Policy says what, controls say how
Symbiotic partners working right now
Trace every control back to policy ground
Make sure every policy has controls to be found
What and how, dancing together
Building trust that lasts forever
[Bridge]
Don't leave policies hanging in the air
Without controls, there's nothing really there
Don't build controls that stand all by themselves
They need policy backing on the shelves
The relationship is give and take
Both are needed for governance sake
One defines intention, one proves it's done
Together they work as a single one
[Chorus]
Policy says what, controls say how
Symbiotic partners working right now
Trace every control back to policy ground
Make sure every policy has controls to be found
What and how, dancing together
Building trust that lasts forever
[Outro]
Ad hoc or aspirational won't do
You need both working, me and you
Symbiotic partners, hand in hand
Controls and policies, perfectly planned