The Audit Cert Deskcoached by AuditDude
Create accountSign in
Audit glossary

Compensating control

A control that reduces a risk when the preferred control isn’t possible.

CISACIA

When a standard control can’t be applied, for example full segregation of duties in a small team, another control can bring the risk down to an acceptable level, such as independent review of the activity logs by a manager.

On the exam

Before recommending anything about a control weakness, the auditor should check whether compensating controls exist. That is often the FIRST step in the answer.

Related terms

  • Segregation of dutiesSplitting key steps of a process so no one person can both commit and hide an error or fraud.
  • Audit trailA record that lets you reconstruct who did what, and when.

Test yourself with today’s question of the day.