During a governance review, an IS auditor notes that an organization's IT department performs code inspections and testing before each release, but there is no documented framework defining overall quality objectives, roles, standards, and continuous improvement processes across all IT activities. Which of the following does the organization MOST likely lack?