In a small organization, management is unable to achieve adequate segregation of duties for its cash- handling procedures Therefore hidden surveillance cameras were installed to monitor…

Question

Options

• ACorrective control
• BProcess-level control
• CCompensating control
• DPreventive control

• A
  5% (2)
• B
  8% (3)
• C
  70% (26)
• D
  16% (6)

Explanation

When an organization cannot implement a primary control - here, segregation of duties - and substitutes an alternative measure to achieve the same control objective, that substitute is called a compensating control. Surveillance cameras serve as a stand-in for proper duty separation: they don't eliminate the structural weakness, but they offset it by providing oversight that discourages and detects misconduct.

Why the distractors fail:

• A (Corrective): Corrective controls act after something goes wrong - like reversing a fraudulent transaction or recovering from a breach. Cameras don't fix anything; they observe.
• B (Process-level): This describes where a control sits (embedded in a business process), not what it does. It's a descriptor of location, not a control type, and doesn't explain the compensating nature of the cameras.
• D (Preventive): Preventive controls stop errors or fraud before they occur (e.g., requiring dual authorization). While cameras may deter, their role here is monitoring, not blocking - and they're introduced specifically because the preventive control (segregation of duties) couldn't be implemented.

Memory tip: Think of it as "can't do Plan A, so we compensate with Plan B." Whenever a question describes a control that fills in for a missing or impractical primary control, that's a compensating control.

No community discussion yet for this question.