Control Design Clinic
This type of control is designed to stop a risk event before it happens, making it generally more effective than finding issues after the fact.
What is a preventive control?
A well executed risk assessment should identify not only weaknesses but also these.
What are strengths?
A customer facing application launches without a required privacy review, suggesting a failure in these controls.
What are governance or change management controls?
When employees continue following an old process after a policy update, this foundational control may have failed.
What are communication and training?
Employees at this major bank opened millions of unauthorized customer accounts to meet aggressive sales targets after controls over sales practices, account authorization, management oversight, and incentive compensation failed to prevent misconduct.
What is Wells Fargo?
A control works flawlessly when one employee performs it, but repeatedly fails when others are assigned the task.
What is key person dependency?
Before recommending additional controls for a high rated risk, Compliance should first evaluate this.
What is the effectiveness of existing controls?
Collecting customer birth dates without a defined business purpose violates this privacy principle.
What is data minimization?
Using the same board report for years despite a changing regulatory environment creates this risk.
What is the risk of ineffective board oversight?
This cryptocurrency exchange collapsed in 2022 after significant failures in corporate governance, risk management, segregation of duties, and financial oversight, allowing customer funds to be improperly used without effective monitoring or independent controls.
What is FTX?
Which review is a stronger control: one based only on a manager's judgment, or one that uses documented criteria and keeps evidence.
What is the review with documented criteria and retained evidence?
When multiple functions identify poor data quality as a concern, it may indicate this.
What is a systemic issue or enterprise wide root cause?
An AML alert is generated but never investigated, meaning this critical activity never occurred.
What is alert review and disposition?
When every dashboard indicator is green but audit findings keep increasing, Compliance should challenge these.
What are the metrics being used?
Attackers had access to this hotel company's reservation system for years before the breach was discovered, highlighting failures in continuous monitoring, log review, and timely detection of unauthorized access.
What is Marriott?
A control requiring numerous spreadsheets, email approvals, and manual reconciliations is most vulnerable to this long term design risk.
What are sustainability concerns?
What is human error risk?
If a low risk area receives significantly more resources than higher risk areas, leadership should question this.
What is whether resources are aligned to risk?
A new customer segment enters the business. Before relying on current AML controls, organizations should revisit this.
What is the AML risk assessment?
A dashboard that highlights trends over time is often more valuable than one that only shows this.
What are point-in-time results?
This energy company collapsed in 2001 after executives used complex accounting schemes to hide debt and inflate profits. The scandal exposed failures in financial reporting, internal controls, board oversight, and auditor independence.
What is Enron?
This situation may be more dangerous than having no control at all because it creates a false sense of security.
What is an ineffective control that is believed to be effective?
A risk appearing in assessments year after year should prompt leadership to ask this key question
What is “Why has the risk not been effectively addressed or reduced?”
A program with strong policies and training but weak monitoring should prioritize strengthening this area.
What are monitoring activities?
This step helps ensure testing results lead to meaningful improvement instead of simply documenting a problem.
What is corrective action or remediation?
This retailer experienced one of the largest data breaches in U.S. history in 2013 when attackers stole payment card information from millions of customers. The incident highlighted weaknesses in third-party vendor management, network monitoring, and access controls.
What is Target?