A small company does not have enough staff to effectively segregate duties to prevent error and fraud in payroll management. The Chief Information Security Officer (CISO) decides to maintain and…

The correct answer is B. Compensating controls. Compensating controls are alternative controls that provide a similar level of protection as the original controls, but are used when the original controls are not feasible or cost-effective. In this case, the CISO implemented compensating controls by reviewing logs and audit…

Submitted by katya_ua· Mar 6, 2026Security operations

Question

A small company does not have enough staff to effectively segregate duties to prevent error and fraud in payroll management. The Chief Information Security Officer (CISO) decides to maintain and review logs and audit trails to mitigate risk. Which of the following did the CISO implement?

Options

ACorrective controls
BCompensating controls
COperational controls
DAdministrative controls

How the community answered

(23 responses)

A
4% (1)
B
78% (18)
C
13% (3)
D
4% (1)

Explanation

Compensating controls are alternative controls that provide a similar level of protection as the original controls, but are used when the original controls are not feasible or cost-effective. In this case, the CISO implemented compensating controls by reviewing logs and audit trails to mitigate the risk of error and fraud in payroll management, since segregating duties was not possible due to the small staff size.

Topics

#Compensating controls#Segregation of duties#Risk mitigation#Audit trails

Community Discussion

No community discussion yet for this question.

Full CS0-003 Practice