Testing often involves specific procedures; a policy specifies those procedures.