A county IRM lead discovers several compensating controls that have quietly become permanent workarounds for open policy exceptions. What should the compliance team validate first?

Compensating controls that quietly become permanent workarounds undermine exception governance. For a county IRM program, compliance should first validate that each compensating control stays temporary, time-bound, and explicitly tracked against its open policy exception until remediated or formally closed—preserving the link between stopgap mitigation and the unresolved deviation. Promoting every compensating control to a permanent control objective without reviewing the exception fails by concept because it launders an unresolved exception into baseline design without risk acceptance of the residual gap. Deleting compensating controls so exceptions remain unmitigated until annual audit fails by concept because removing interim protection increases exposure while waiting for fieldwork. Closing exceptions automatically whenever any compensating control exists fails by concept because presence of a stopgap does not prove the original control intent is met or residual risk is acceptable. Exam caveat: CIS-RC treats compensating controls as time-bound companions to open exceptions, not silent permanent replacements. Operational check: list open exceptions with compensating controls, confirm each has an expiry or review date and linkage to the exception, and escalate any undated permanent workarounds for remediation or formal closure.