Topics in this domain
- Risk Response Options: Accept, Mitigate, Transfer, Avoid
- Aligning Responses with Appetite and Tolerance
- Cost-Benefit Analysis of Risk Responses
- Bias in Risk Decisions and Reporting
- Risk Owners and Control Owners
- RACI and Escalation
- Third-Party Risk Governance and Due Diligence
- Contracts, SLAs and the Right to Audit
- Monitoring Third Parties and Planning Exit
- Managing Issues, Findings and Control Deviations
- Risk Acceptance, Exceptions and Exemptions
- Control Frameworks and Their Purpose
- Control Types and Functions
- Designing and Selecting Controls
- Implementing Controls and Why Implementations Fail
- Control Design versus Operating Effectiveness
- Control Testing: Objectives, Evidence and Frequency
- Building and Tracking Risk Action Plans
- Collecting and Aggregating Risk Data
- Validating Risk Data Quality
- KRIs, KPIs and KCIs
- Thresholds, Escalation Triggers and Appetite
- Metric Pitfalls and Misuse
- Continuous Monitoring versus Periodic Assessment
- Tailoring Risk Reports to the Audience
- Heat Maps, Dashboards and Scorecards
- Identifying and Assessing Emerging Risks
- Integrating Emerging Risk into Decisions
Control Design versus Operating Effectiveness
Two questions
Design first
If an access review excludes administrator accounts, it can’t control privileged access however diligently it’s performed. Finding that design gap first saves time and points straight to the fix.
Evidence for each
| Question | Typical evidence |
|---|---|
| Design | Walkthrough, design documents, one example traced |
| Operation | Samples across the period, logs, sign-offs |
Example. A change control was well designed: every change needed CAB approval. Sampling 40 changes found 9 deployed before approval during month-end. Design effective; operation not.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Test FIRST | Design effectiveness |
| Control can’t meet its objective | Design deficiency |
| Control not performed consistently | Operating deficiency |
| Evidence for operating effectiveness | Samples across the period |
In short
- Design effectiveness asks whether the control, if performed as designed, would achieve its objective.
- Operating effectiveness asks whether it was performed consistently, as designed, throughout the period.
- Test design first; if the design is flawed, testing operation is wasted effort.
- Design is often confirmed with a walkthrough; operation needs samples across the period.
- Both must be effective for the control to reduce risk as expected.
Exam traps
- Testing operation of a control whose design can't achieve its objective.
- Concluding a control operated all year from one walkthrough.
- Assuming a well-documented control operates.
- Ignoring changes to a control during the period.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Two questions
1 / 7