Requirement
The entity selects and develops control activities that contribute to the mitigation of risks to the achievement of objectives to acceptable levels.
Points of Focus
Integrates With Risk Assessment
Requirement: Control activities help ensure that risk responses that address and mitigate risks are carried out.
Considers Entity-Specific Factors
Requirement: Management considers how the environment, complexity, nature, and scope of its operations, as well as the specific characteristics of its organization, affect the selection and development of control activities.
Determines Relevant Business Processes
Requirement: Management determines which relevant business processes require control activities.
Evaluates a Mix of Control Activity Types
Requirement: Control activities include a range and variety of controls and may include a balance of approaches to mitigate risks, considering both manual and automated controls, and preventive and detective controls.
Considers at What Level Activities Are Applied
Requirement: Management considers control activities at various levels in the entity.
Addresses Segregation of Duties
Requirement: Management segregates incompatible duties and, where such segregation is not practical, management selects and develops alternative control activities.
Explanation
Once risks are identified, the organization must choose and build control activities that actually reduce them to acceptable levels, tailored to its size, complexity, and business processes. Auditors look for a deliberate mix of preventive and detective, manual and automated controls, and for segregation of incompatible duties or compensating alternatives.
