Which term is an internal control that reduces risk of a control weakness by providing an alternative safeguard?

Which term is an internal control that reduces risk of a control weakness by providing an alternative safeguard?

• A. Detective control
• B. Control owner
• C. Compensating control
• D. Corrective control

Answer: (C)

A compensating control is used when the primary safeguard isn’t feasible or has a weakness, providing an alternative measure that still reduces risk to an acceptable level. It’s designed to achieve the same security objective through a different mechanism, so the overall risk remains controlled even though the original control can’t be fully implemented. Detective controls, in contrast, only identify that something has occurred after the fact and don’t substitute for preventing or mitigating a weakness. Corrective controls focus on restoring systems or processes after an incident, rather than offering an alternative safeguard to a missing or weak control. A control owner is simply the person responsible for the control, not a type of control. For example, if a primary control for limiting access is not feasible due to system constraints, a compensating control might combine enhanced access reviews, mandatory dual approvals for high-risk actions, and detailed audit logs to achieve a similar level of risk reduction.

A compensating control is used when the primary safeguard isn’t feasible or has a weakness, providing an alternative measure that still reduces risk to an acceptable level. It’s designed to achieve the same security objective through a different mechanism, so the overall risk remains controlled even though the original control can’t be fully implemented.

Detective controls, in contrast, only identify that something has occurred after the fact and don’t substitute for preventing or mitigating a weakness. Corrective controls focus on restoring systems or processes after an incident, rather than offering an alternative safeguard to a missing or weak control. A control owner is simply the person responsible for the control, not a type of control.

For example, if a primary control for limiting access is not feasible due to system constraints, a compensating control might combine enhanced access reviews, mandatory dual approvals for high-risk actions, and detailed audit logs to achieve a similar level of risk reduction.