Key Control Definition and Control Design Gap Analysis

Control effectiveness has two components: design effectiveness and operational effectiveness.  Design effectiveness refers to whether controls are properly designed to achieve control objectives if they operate as defined; Operating Effectiveness refers to whether controls consistently operate as designed.  This phase addresses the design effectiveness of controls.

At this point, processes have been documented, control objectives have been defined and control activities have been described.  The primary goal of this function is to identify the controls that most effectively and efficiently achieve the control objectives – i.e., the “Key Controls”.    Having too many controls will result in excessive documentation, testing, analysis and assessment efforts, and potentially inefficient business processes.  Having too few controls will result in “design gaps”, or inadequate Control Activities to achieve Control Objectives.   It is here that the objective/control matrix tool is most helpful.  This tool is used to determine whether each Control Objective is addressed by an adequate group of Control Activities and whether there may be redundant Control Activities.  Also, you can identify Control Activities that might effectively address multiple Control Objectives, thus reducing the total number of Key Controls.  A careful analysis at this stage will identify Key Controls and any need for additional controls where “gaps” exist.

The Precipio Group has the expertise to help you analyze the most effective and efficient set of Key Controls (including IT controls) for your business, including the design of new Control Activities when necessary.