Control Identification, Design, and Control Taxonomy
Core concepts
Controls are actions, policies, devices, practices, or mechanisms that modify risk. Candidates must know the common classification schemes: preventive versus detective versus corrective; manual versus automated; and key (primary) versus secondary or compensating. A control description should state what it does, who performs it, how often, what evidence it produces, and the risk it addresses - one control may map to multiple risks, and risks may need layered controls.
Design effectiveness asks whether a control, as designed, would reasonably mitigate the risk if operated as intended. This is assessed before testing operation. Design attributes include appropriateness (does it address the specific risk), precision (thresholds and tolerances), timeliness (detection before harm), authority (right level of approval), and evidence (a record exists). Automated controls generally provide more consistent application but require change-management and access controls over the system itself; manual controls are prone to inconsistency and override.
Traps
Common traps: assuming a control exists because a policy exists (a policy is an enabling document, not necessarily an operating control); confusing compensating controls with primary controls; and accepting a detective control where prevention is required by regulation. Another trap is mapping a control so broadly that its effectiveness cannot be tested, or ignoring segregation-of-duties conflicts in control design.
Worked example / rule of thumb
Rule of thumb: "Describe the control so a stranger could test it." Example: instead of "management reviews reconciliations," write "The controller reviews and signs the daily nostro reconciliation by 11:00 the next business day; exceptions over a set threshold are escalated to the treasurer and logged." This names performer, frequency, timing, threshold, and evidence - the elements a design assessment and later test can rely on.