Criterion CC5.3The entity deploys control activities through policies that establish what is expected and in procedures that put policies into action.

COSO Principle 12: The entity deploys control activities through policies that establish what is expected and in procedures that put policies into action.

SOC 2, the trust services criteria, CC5.3

Criterion text: 2017 Trust Services Criteria (with revised points of focus, 2022). © 2022 Association of International Certified Professional Accountants. All rights reserved. COSO principles © 2019 Committee of Sponsoring Organizations of the Treadway Commission (COSO). All rights reserved. Reproduced from copies of AICPA's published text; check it against AICPA's own before relying on it.