Controls should be selected based on their ability to help the organization meet regulatory obligations and demonstrate compliance with regulators and stakeholders.