Compensating Control

Sometimes the standard control is not possible. A small team may have too few staff to separate duties, a legacy system may not support a required access setting, or a deadline may force a manual workaround. A compensating control is then put in place to cover the same risk by other means. It has to be at least as effective as the one it replaces, which means it must be well designed, documented and actually tested, not just assumed. Typical examples are a supervisor reviewing every transaction a single employee handled, or extra monitoring on a system that cannot be patched. Auditors also use the term when they decide whether a control gap is serious: if a compensating control works, the gap may be rated lower. Without one, a known gap is either fixed at once or accepted in full, and a working substitute gives a third option.

A small subsidiary has one accountant who both raises and approves supplier payments. Hiring a second person is not affordable. The parent company introduces a monthly review where the finance director checks every payment over a set amount against invoices and bank records. Internal audit tests the review and accepts it as a compensating control.