Compensating controls when the ideal is impossible

Exam

CISA & CISM

What it means

When segregation of duties, patching or another control can't be implemented, look for compensating controls plus formal risk acceptance, not doing nothing and not shutting down the business.

The trap answer looks like

Do nothing because the ideal control is not possible, or shut the business process down.

The winning answer looks like

Apply a compensating control and have the residual risk formally accepted.

Worked example

A small team cannot segregate administration duties. What is BEST?

✅ Independent review of activity logs by someone who is not an administrator

When you cannot split the job, watch the job.