3.7 Control Design & Implementation
Control design and implementation is one of the important steps in risk management. Control can be either proactive or reactive. Proactive controls attempt to prevent an adverse impact whereas reactive control attempts to detect and recover from an incident. Proactive control is also known as safeguards whereas reactive control is also known as countermeasures. Use of a physical security guard outside the processing area is a proactive control or safeguard to prevent any unauthorized entry. Use of a fire extinguisher is a reactive control or countermeasure against the risk of fire.
All the implemented controls should be documented in a risk register.
An effective control should be able to prevent or detect and recover from the event with minimum adverse impact.
The most important factor for designing IS controls is that they should be aligned with the requirements of the business processes and should be able to address the stakeholder’s requirement. Process owners should provide the control requirements on the basis of the business needs and objectives.
Role of risk advisor is to provide advice on the control selection and implementation procedure. Risk practitioners should evaluate the adequacy of the current controls. In case current controls are not sufficient, he should recommend implementation of new controls.
Internal controls should be incorporated in the new system development at the design phase itself. This will help in designing and developing effective and efficient internal control systems.
Board of directors and senior management is accountable for risk policies, guidelines and standards.
Compensating Controls
In some scenarios, it may not be feasible to implement controls. For example, in small organizations, segregation of duties may not be cost effective. In such cases, risk practitioners should recommend the implementation of compensating controls. Compensating controls are an indirect way to monitor and control the transaction. For lack of segregation of duties, compensating control may be monitoring of transaction logs and conducting audits.
Threat vis-à-vis Vulnerability
CRISC aspirants should be able to establish the difference between threat and vulnerability. Vulnerability means weakness in the system. Threat is a factor that attempts to exploit the vulnerability. For example, when an anti-virus is not updated it is a vulnerability. Hacker who attempts to exploit the vulnerability (un-updated anti-virus) is a threat. Objective of an internal control is to reduce the vulnerability i.e. weakness. Internal control cannot directly control the threat.
Control Standards and Frameworks
Implementation of control requires documented policies and procedures. Accountability should be established for control implementation and monitoring. Implementation of industry specific standards and frameworks helps an organization to build a structured control environment.
ISO 27001 standard is a widely accepted and recognized standard for information security management systems (ISMS). Payment Card Industry Data Security Standard (PCI DSS) is used by all organizations that process debit or credit cards. HIPAA is a recognized standard for the health industry.
Many countries require mandatory implementation of certain standards by the organization.
Administrative, Technical and Physical Controls
Following are the details of different types of control:
Managerial/ Administrative
Managerial control involves oversight of the processes.
Examples of managerial controls are policies and procedures, audit, risk and compliance reporting etc.
Managerial control aims to monitor the function of technical as well as physical control.
Technical
In technical controls, control is implemented through use of technology and with minimum human intervention.
They are also termed as logical controls.
Examples of technical controls include logical access, firewalls, antivirus software, IDS etc.
A technical control requires proper managerial (administrative) controls to operate correctly.
Physical
In physical controls, the objective is to control physical movement of employees and assets.
Examples of physical control include security guards, locks, fences, CCTV and devices that are installed to physically restrict access to a facility or hardware.
Preventive, Corrective, Detective, Deterrent, Compensating Controls
Following table depicts details of different types of control:
Preventive Control
Preventative controls are designed to be implemented in such a way that it prevents the threat event and thus avoid the potential impact.
Examples of preventive controls include:
Use of qualified personnel
Segregation of duties
Use of SOPs to prevent errors
Transaction authorization procedures
Edit checks
Access control procedures
Firewalls
Physical barriers
Detective Control
Detective controls are designed to detect a threat event once the event has occurred. Detective controls aim to reduce the impact of the event.
Examples of detective controls include:
Internal Audit & other reviews
Log monitoring
Hash totals
Checkpoints in production jobs
Echo controls in telecommunications
Error messages over tape labels
Variance Analysis
Quality Assurance
Corrective Control
Corrective controls are designed to minimize the impact of a threat event once it has occurred and helps in restoring to normal operations.
Examples of corrective controls include:
Business continuity planning
Disaster recovery planning
Incident response planning
Backup procedures
Deterrent Control
Purpose of a deterrent control is to give a warning signal to deter or discourage the threat event.
Examples of deterrent controls include:
CCTV cameras - under surveillance signs
Warning signs
Compensating Controls
Compensating controls are alternate measures that are employed to ensure that weakness in the system is not exploited. In many cases, a strong control in one area can compensate for weakness in another area.
For example, in small organizations, segregation of duties may not always be feasible. In such cases, compensatory controls such as review of log should be implemented.
Key aspects from CRISC exam perspective
|
CRISC
Question
|
Possible
Answer
|
|
MOST important factor for designing the controls
|
To address the stakeholder’s requirements
|
|
Best method for creating access rights for
temporary staffs
|
·
With auto expiration date
·
Only need to know access
|
|
Best control to protect data within a USB devices
|
Encryption
|
|
System backup and restore procedures is example of
|
Corrective control
|
|
Internal control should be incorporate in which SDLC
phase
|
Design Phase
|
|
Accountability for risk policies, guidelines and
standards
|
·
Board of Directors
·
Sr. Management
|
|
Internal
control requirement should be provided by
|
·
Process owners
|
|
Controls
are most effective when they are designed to reduce
|
Vulnerabilities
|
|
Example
of managerial controls
|
· Policies and procedures
· Audit, risk and compliance reporting etc.
|