Measuring control effectiveness in risk management | BCS Information Risk Management & Assurance SG скачать в хорошем качестве

Measuring control effectiveness in risk management | BCS Information Risk Management & Assurance SG

For many years the assurance community simply defined controls as being either preventive, detective, or corrective (reactive). In the late 1990s, List & Brewer categorised these definitions into seven control classifications which provided the first hint that not all controls were one hundred percent operationally effective. However, they did not attempt to measure their effectiveness on a standard scale but rather left it to the judgement of the individual. Sarbanes Oxley went a stage further in 2002 by requiring companies to identify and document their controls and then to regularly test their operation, but again on the premise that a control was one hundred percent effective. This presentation will show that many controls are not effectively mitigating the risk that they were designed to manage. An algorithm will be offered which can be used to measure the effectiveness of any control and provide supporting evidence as to how the result was obtained. Examples will support the efficacy of this method in helping to improve management’s understanding of control in managing business risks.