Policy

Management’s dictate of what should be done to effect control. A policy serves as the basis for procedures for its implementation.

Source : COSO Integrated Internal Controls Framework, COSO Integrated Risk Management Framework