A control environment is defined as: (i) An inventory of the security policy controls (ii) A well-defined framework to track control exceptions (iii) A term describing the overall way in which the organization's controls are governed and executed