Which of the following is the BEST indicator of the effectiveness of a control?

The scope of control coverage defines what the control aims to protect, but not how well it performs its function within that scope.

The number of exceptions granted indicates flexibility or policy overrides, but doesn't directly measure the underlying operational effectiveness of the control itself.

The number of steps necessary to operate a process relates to efficiency and complexity, not directly to the control's effectiveness in mitigating risk.

The number of control deviations detected directly measures how often a control fails to operate as intended, whether it's failing to prevent a risk or failing to detect a missed prevention. A low number of deviations suggests the control is generally effective, while a high number indicates ineffectiveness, prompting investigation and remediation.