IT policy and control implementation