Internal control policy