A facility for representing a mandate occurring in an authority document with a control is described. For each of one or more controls in a set of existing controls, the facility determines a similarity score measuring the similarity of the mandate and the control; where the similarity score exceeds a similarity threshold, the facility links the mandate to the control. Where the mandate is not linked to any control in the set of controls, the facility adds a control to the set of controls that is based on the mandate, and links the mandate to the added control.