Which of the following BEST enables effective IT control implementation?

Key risk indicators (KRIs) are for monitoring risk exposure, not for guiding the implementation of controls.

Documented procedures provide explicit, step-by-step instructions on how to perform specific tasks or implement controls consistently and correctly. This clarity ensures that controls are executed as intended, reducing errors and variations, and making them auditable and repeatable, which is crucial for effective implementation.

Information security policies establish the overall strategic direction and high-level requirements for security, but they do not provide the detailed instructions for implementing specific controls.

Information security standards provide mandatory requirements and specifications, but they typically focus on what must be achieved, not the granular how-to for implementation that procedures offer.