How do we know?
We are doing what we are supposed to do...GOVERNANCE
Risks are addressed...RISK
We are following laws, regulations, requirements, policies and procedures...COMPLIANCE
4