Who verifies the implementation of controls?

I have your documentation toolkit - in the document called “Checklist of Mandatory Documentation” the “Mobile device policy” is in the list of “Commonly used non-mandatory documents”. As for A.6.2.1 A policy and supporting security measures shall be adopted…. I understand that we don’t need to write such a policy as the control does not say “shall be documented” but it just feels strange to not have a policy in written form… Is it a part of the Audit (internal and external) to verify that everyone knows how to handle mobile devices?