Topics in this domain
- Risk Response Options: Accept, Mitigate, Transfer, Avoid
- Aligning Responses with Appetite and Tolerance
- Cost-Benefit Analysis of Risk Responses
- Bias in Risk Decisions and Reporting
- Risk Owners and Control Owners
- RACI and Escalation
- Third-Party Risk Governance and Due Diligence
- Contracts, SLAs and the Right to Audit
- Monitoring Third Parties and Planning Exit
- Managing Issues, Findings and Control Deviations
- Risk Acceptance, Exceptions and Exemptions
- Control Frameworks and Their Purpose
- Control Types and Functions
- Designing and Selecting Controls
- Implementing Controls and Why Implementations Fail
- Control Design versus Operating Effectiveness
- Control Testing: Objectives, Evidence and Frequency
- Building and Tracking Risk Action Plans
- Collecting and Aggregating Risk Data
- Validating Risk Data Quality
- KRIs, KPIs and KCIs
- Thresholds, Escalation Triggers and Appetite
- Metric Pitfalls and Misuse
- Continuous Monitoring versus Periodic Assessment
- Tailoring Risk Reports to the Audience
- Heat Maps, Dashboards and Scorecards
- Identifying and Assessing Emerging Risks
- Integrating Emerging Risk into Decisions
Control Frameworks and Their Purpose
Why use a control framework
Frameworks save the organisation from inventing controls from scratch, give auditors and regulators a familiar structure, and make gaps easier to spot. They’re a starting point; risk assessment decides what’s actually needed.
Main catalogues
COBIT and COSO’s internal control framework also shape how many organisations think about controls.
Use as a menu, not a checklist
- Start from the risk scenarios and appetite.
- Select controls that address those risks.
- Justify exclusions, for example in a Statement of Applicability.
- Map the selected controls to every relevant framework.
Example. A company subject to ISO 27001 and PCI DSS maps one access review control to both. Auditors from each scheme test the same control, and the team runs one process instead of two.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| PRIMARY benefit of a control framework | A structured, tested set of controls and a common language |
| How to choose controls from a catalogue | Based on risk assessment |
| Several frameworks apply | Map one control set to all of them |
| Framework compliance achieved | Doesn’t on its own prove risk is within appetite |
In short
- Control frameworks give a tested, structured set of controls and a common language.
- Common catalogues include ISO/IEC 27002, NIST SP 800-53, CIS Controls, COBIT and PCI DSS.
- Use frameworks as a menu: risk assessment decides which controls apply and how strongly.
- Mapping one control set to several frameworks reduces duplication.
- COSO's internal control framework underpins control thinking in many organisations.
Exam traps
- Implementing every control in a catalogue regardless of risk.
- Treating framework compliance as proof that risk is managed.
- Running separate control programs for each framework.
- Confusing a control framework with a risk management framework.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Main catalogues
1 / 7