Risk Response and Reporting · Topic 5 of 9
Control Design, Selection, Implementation and Analysis
CRISC control design: design principles, cost-benefit selection, working with control owners, gap analysis, adequacy, effectiveness and maturity.
- 5 min
- Start with the current state; the gap to the desired state drives control selection.
- Design for defense in depth, least privilege, segregation of duties and fail secure.
- A control's total cost should not exceed the risk reduction, unless legally required.
What it is
Control design decides what a control must do and how it will work. Selection chooses the controls that best reduce a risk for the cost. Implementation puts them into operation, and analysis evaluates whether the control environment is adequate, effective and mature enough for the risk.
The practitioner collaborates with control owners at every stage. The practitioner brings risk analysis and requirements; the control owner brings operational knowledge and runs the control.
How it works
Start from the current state
Before adding controls, the practitioner identifies what already exists and how well it works. Interviews, documentation, control inventories and previous test results show the current state. Comparing it with the desired state, set by appetite, policy and regulation, gives the gap that the new controls must close.
Design principles
| Principle | Meaning |
|---|---|
| Risk-based | Strength of control matches the size of the risk |
| Defense in depth | Several layers so one failure does not cause a loss |
| Least privilege | Users and systems get only the access they need |
| Segregation of duties | No single person controls a sensitive process end to end |
| Fail secure | If the control fails, it fails to a safe state |
| Simplicity | Simple controls are easier to run, test and trust |
| Measurable | The control produces evidence that it is working |
A well-designed control also states its objective, the risk it addresses, its owner, frequency, and the evidence it produces.
Selection criteria
| Criterion | Question |
|---|---|
| Effectiveness | How much does it reduce likelihood or impact? |
| Cost and benefit | Do total costs, including running and maintenance, justify the reduction? |
| Compatibility | Does it fit current technology and processes? |
| Usability | Will people use it, or work around it? |
| Compliance | Does a law, regulation or contract require it? |
| Side effects | Does it create new risks, such as a single point of failure? |
The cost of a control should not exceed the value of the risk reduction it delivers, unless it is legally required.
Implementation
Good implementation follows change management: requirements, testing before production, approval, deployment, documentation and training. The control is formally handed to its control owner, with procedures and the evidence it must produce. Monitoring starts at go-live, and the risk register is updated with the new residual risk once effectiveness is confirmed.
Analysing the control environment
| Attribute | Question it answers |
|---|---|
| Adequacy | Is the design sufficient to address the risk? |
| Effectiveness | Does the control operate as intended, consistently, over time? |
| Efficiency | Does it achieve its goal at reasonable cost and effort? |
| Maturity | How well defined, managed and improved is the process behind it? |
COBIT 2019 rates process capability on a scale from 0 (incomplete) to 5 (optimizing). A capability or maturity assessment compares the current level with a target level agreed with management, and the gap becomes part of the improvement plan.
Control analysis also looks for overlaps, where several controls do the same job and cost can be cut, and single points of failure, where one control carries a large risk alone.
Maintaining controls
Controls degrade as systems, staff and threats change. Control owners keep procedures current, review settings, and report failures. The practitioner monitors KCIs and test results and recommends changes when a control no longer meets its objective.
A worked example
A company's risk of fraudulent supplier payments is above appetite. The current state shows one preventive control: an approver reviews each payment. Testing shows approvers sign off large batches without review.
The practitioner and the finance controller, as control owner, design improvements. Bank detail changes now need call-back verification to a known number (preventive). The payment system blocks payments to bank details changed in the last 48 hours without a second approver (preventive, automated).
A weekly report of changed supplier bank details is reviewed by someone outside accounts payable (detective). After implementation and a successful test, residual risk falls within appetite.
How the exam asks about this
- "What should the practitioner do FIRST before recommending new controls?" Identify the existing controls and evaluate their effectiveness.
- "Which is the MOST important consideration when selecting a control?" That it reduces the risk to within appetite at a cost justified by the benefit.
- "Who is responsible for implementing and maintaining a control?" The control owner, supported by the practitioner.
What to remember for the exam
- Start with the current state; the gap to the desired state drives control selection.
- Design for defense in depth, least privilege, segregation of duties and fail secure.
- A control's total cost should not exceed the risk reduction, unless legally required.
- Assess controls for adequacy, effectiveness, efficiency and maturity.
- COBIT 2019 capability levels run from 0 to 5.
A new control does not lower residual risk until it is shown to work. Update the risk rating after testing confirms effectiveness, not on the day the control is installed.
Common mistakes
Adding controls before checking existing ones. The gap may be in how a current control operates, not a missing control.
Ignoring running costs. Licences, staff time and maintenance often exceed the purchase cost.
Designing controls people will avoid. A control that slows work too much creates workarounds and new risk.
Check yourself
What is the difference between control adequacy and effectiveness?
Adequacy asks whether the design is sufficient for the risk; effectiveness asks whether the control actually operates as intended over time.
Why does the practitioner perform a gap analysis before selecting controls?
To see how far current controls fall short of the desired state, so new controls target the real gap.
When should residual risk be updated after a new control is implemented?
After testing confirms the control is operating effectively.
Topic 5 of 9 in Risk Response and Reporting
Test yourself on Risk Response and Reporting
The full ISACA CRISC question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.