A policy is not a control. A process is not evidence. Understanding the distinction between designing controls and demonstrating their effectiveness is fundamental to audit readiness.
Control design asks: is there a control that, if operated as intended, would address the risk? Control effectiveness asks: is it actually operating, consistently, with evidence? Audits fail far more often on the second question than the first.
Effectiveness is a by-product of operating a control in a way that leaves a trail — approvals, logs, review records, exception reports. If producing evidence requires special effort at audit time, the control is not really embedded.