They work in a closed loop system. Everything is verified. You must plan before you perform. If you look at CMMC assessment guides almost all practices start with a governance objective, followed by a procedural objective