policies are dictated by the business objectives and the controllers