Topics in this domain
- Risk Response Options: Accept, Mitigate, Transfer, Avoid
- Aligning Responses with Appetite and Tolerance
- Cost-Benefit Analysis of Risk Responses
- Bias in Risk Decisions and Reporting
- Risk Owners and Control Owners
- RACI and Escalation
- Third-Party Risk Governance and Due Diligence
- Contracts, SLAs and the Right to Audit
- Monitoring Third Parties and Planning Exit
- Managing Issues, Findings and Control Deviations
- Risk Acceptance, Exceptions and Exemptions
- Control Frameworks and Their Purpose
- Control Types and Functions
- Designing and Selecting Controls
- Implementing Controls and Why Implementations Fail
- Control Design versus Operating Effectiveness
- Control Testing: Objectives, Evidence and Frequency
- Building and Tracking Risk Action Plans
- Collecting and Aggregating Risk Data
- Validating Risk Data Quality
- KRIs, KPIs and KCIs
- Thresholds, Escalation Triggers and Appetite
- Metric Pitfalls and Misuse
- Continuous Monitoring versus Periodic Assessment
- Tailoring Risk Reports to the Audience
- Heat Maps, Dashboards and Scorecards
- Identifying and Assessing Emerging Risks
- Integrating Emerging Risk into Decisions
Control Types and Functions
Functions over time
Compensating controls provide equivalent protection when the preferred control isn’t possible, but only if someone independent of the original weakness performs them.
Function and type together
Likelihood or impact?
| Function | Mainly reduces |
|---|---|
| Deterrent, preventive | Likelihood |
| Detective | Impact, by catching problems early |
| Corrective | Impact, by recovering |
Example. For ransomware, MFA and patching are preventive, EDR alerts are detective, and immutable backups are corrective. If prevention fails, detection and correction keep a bad day from becoming a disaster.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Restoring from backup | Corrective |
| Reviewing logs | Detective |
| Control replacing one that can’t be used | Compensating |
| Reduce the impact of a risk | Detective or corrective controls |
In short
- Control functions describe when a control acts: deterrent and preventive before, detective during or after, corrective after.
- Compensating controls provide equivalent protection when the preferred control isn't possible.
- Control types describe how they're implemented: administrative, technical or physical.
- Preventive controls reduce likelihood; detective and corrective controls reduce impact.
- Layering different functions and types gives defence in depth.
Exam traps
- Thinking preventive controls make detective controls unnecessary.
- Classifying a backup restore as preventive; it's corrective.
- Using a compensating control performed by the person with the conflict.
- Relying on one type of control for a critical risk.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Functions over time
Function and type together
1 / 7