What the six criteria which might be used to evaluate an organization's policies and procedures?