Comment by orev

When the audit happens, the auditors also consider if the policy meets the control objectives. If it doesn’t, you’re going to fail.