Build the control architecture.

Translate the business problem into controls that can be owned, operated, evidenced and reviewed.