A “control” is a procedure, policy, or task that provides ‘reasonable assurance’ that the organization or process operates as designed. Robin Kennedy, MA, CISA, CRISC