What changes when policies leave the document and become evidence, habits, escalation routes and accountable work.
Controls look tidy on paper because paper removes the interruptions, competing priorities and handovers that shape real work. The useful test begins after publication: can the right person perform the control, understand why it matters and show what happened without a special campaign?
Walk through one control with the people who perform it. Notice where information arrives late, where definitions differ and where a system does not support the promised process. These small frictions explain more than a policy exception count.
A good control includes a normal path and a safe response when the normal path breaks. Clarify who is notified, what decision they can make, and how quickly. Escalation is part of control design, not a sign that design failed.
Evidence should be findable, dated and proportionate to the claim it supports. Agree the source of truth and the minimum record at the point of work. This reduces audit effort while giving operators feedback they can use.