which type of control specifies how something is to be done through policies, rules, standard operating procedures, and orders from a superior?