Policies, processes and internal control