Interview Question: Difference between control design or control effectiveness ?

[Manikantahere]

I don't remember exactly the question but it sounds more like above as I remembered can any one give me insights about difference between control design or control effectiveness??

[Community Alums · Accepted solution]

Hi @Manikantahere ,

Control design and operating effectiveness" refers to two critical aspects of internal control systems within an organization, particularly in the context of risk management, financial reporting, and regulatory compliance.

Control Design: Control design involves the development and establishment of control measures, policies, and procedures within an organization. These controls are designed to mitigate specific risks, maintain the integrity of financial information, and ensure compliance with regulations.

Operating Effectiveness: Operating effectiveness assesses how well the established controls are functioning in practice. It focuses on evaluating whether the controls are operating as intended to mitigate risks and achieve control objectives.Testing and monitoring: Regular testing and monitoring of controls to ensure they are functioning as designed. This may involve internal audits, self-assessments, or third-party assessments. Compliance and performance: Evaluating not only whether the controls are in place but also if they are consistently adhered to and are achieving their intended results.

[Community Alums · Accepted solution]

Hi @Manikantahere ,

Control design and operating effectiveness" refers to two critical aspects of internal control systems within an organization, particularly in the context of risk management, financial reporting, and regulatory compliance.

Control Design: Control design involves the development and establishment of control measures, policies, and procedures within an organization. These controls are designed to mitigate specific risks, maintain the integrity of financial information, and ensure compliance with regulations.

Operating Effectiveness: Operating effectiveness assesses how well the established controls are functioning in practice. It focuses on evaluating whether the controls are operating as intended to mitigate risks and achieve control objectives.Testing and monitoring: Regular testing and monitoring of controls to ensure they are functioning as designed. This may involve internal audits, self-assessments, or third-party assessments. Compliance and performance: Evaluating not only whether the controls are in place but also if they are consistently adhered to and are achieving their intended results.

[Community Alums]

Hi @Manikantahere ,

[Manikantahere]

@Community Alums  so controls are comes under control design effectiveness where as indicators are comes under control operative effectiveness is that right?? 

[Phil Swann · Accepted solution]

If you take a look at the Audit Management application, which is really there to provide 3rd Line Assurance; for an Engagement you can perform Control Tests.

Control Tests contain two types of Effectiveness:

- Design Effectiveness 

- Operational Effectiveness

These are both looking at the Control and checking according to the assessment procedures defined for each Control, how is it designed? (E.g.  would the objective be achieved if it were operated effectively?) 

how is it operating? (e.g. is it performing as expected?)

Typically, you will only test the operational effectiveness if the design is effective as there is no point to check the operational performance for a poorly designed control. 

This goes beyond the testing of the control from a self-assessment/attestation, which is really for me more about ownership and acknowledgement. Indicators provide some continuous monitoring of the performance, but these in themselves could either be answered incorrectly or without sufficient evidence, or indeed be poorly configured. So we would not expect an organisation to rely entirely on them, in their own right. 

Enter stage left: Audit Management, 3rd Line Assurance... Control Testing! 

The hero in our story here will review the Control, any issues and indicator results for the audit period. 

I like to say that a Control Test "reigns supreme".

What I mean by that, is even if there is an issue on the control and it is non-compliant, the Control Test can decide to close it by marking it effective. Equally, if the Control is compliant, with no issues, the Control Test can be marked ineffective - generating a Control Test Issue... 

Hope it helps! 

Regards the interview question in particular. I don't know how this is going to help there, if you don't know something - I always suggest you to be honest and have a conversation around what you do know and how you can learn!!

Best of luck..