[Verse 1] Mary reviews vendor contracts each quarter when budgets shift That's how control statements should be built, not just a drift Who does what, when it happens, under which circumstance No vague words like "management" - give us substance, not romance [Chorus] Actor, Action, Object - who and what and where Frequency and Condition - when and under what care Five elements dancing in your policy prose Rewrite those muddy statements till clarity shows A-A-O-F-C, that's the recipe Transform confusion into accountability [Verse 2] "Staff will monitor systems appropriately" Sounds official but means absolutely nothing, see? Which staff member? Monitor how? What systems exactly? How often should they check? Transform it more compactly [Chorus] Actor, Action, Object - who and what and where Frequency and Condition - when and under what care Five elements dancing in your policy prose Rewrite those muddy statements till clarity shows A-A-O-F-C, that's the recipe Transform confusion into accountability [Bridge] Take "Employees must ensure compliance with regulations" Generic garbage causing workplace complications Sarah validates expense reports monthly when exceeding limits Now that's control writing with definite imprints [Verse 3] "Management oversees operations as needed" Whose management? Which operations? Context deleted IT Director Jenkins audits database access weekly during maintenance windows Specificity like architecture - strong foundational sinews [Chorus] Actor, Action, Object - who and what and where Frequency and Condition - when and under what care Five elements dancing in your policy prose Rewrite those muddy statements till clarity shows A-A-O-F-C, that's the recipe Transform confusion into accountability [Outro] From fuzzy policies to crystal legislation Five elements cure administrative frustration
← Exercise 3: Framework Mapping | Exercise 5: Compensating Control Design →