3.8 Control Monitoring and Effectiveness
Risk practitioners should ensure that appropriate processes are in place to evaluate and monitor the effectiveness of the control.
Best way to determine the control effectiveness is to test the controls. Controls are to be tested at frequent intervals. Also, internal controls to be evaluated at regular intervals.
The risk professional role is very important in control monitoring. Role of risk practitioner in the control monitoring process is to assist in planning, reporting and scheduling tests of IS controls.
Maintaining controls at an optimal level helps to maintain a balance between control cost and control effectiveness & benefit. Control is said to be optimum when cost of control is less than the perceived risk. At optimum level of control, there is balance between control effectiveness and control cost. Control should be able to provide value to the organization.
Adherence to laws and regulations is one of the most important external requirements for an organization. Control should be implemented and monitored at periodic intervals to ensure that the organization is complying with legal and regulatory requirements. Legal and Regulatory requirements are the most important external requirements to which compliance should be monitored.
Control Monitoring and Reporting Tools and Techniques
While designing the control, care should be taken to address the control monitoring process.
Monitoring and reporting of controls should be performed in the risk monitoring phase of risk management.
In case controls are monitored through a managed security service provider (MSSP) or a security information and event management (SIEM), the system should have capability to capture and analyze the data.