Compensating control
- Term
- Compensating control
- Exam
- CISA & CISM
- Definition
A control that reduces risk when a primary control cannot be implemented.
- Explained
A compensating control reduces risk when the preferred control cannot be implemented — for example, independent log review where duties cannot be segregated in a small team. It should be paired with documented risk acceptance by the owner.
- In practice
A single administrator's actions are reviewed weekly by the finance manager.
- Often confused with
- Corrective control
- Exam angle
Classic example: independent log review when duties cannot be segregated.
- Related