An internal audit finds that a required control is not implemented on a payments system. The system team says a different control already in place compensates for it. What should the information security manager do FIRST?
Select an answer to reveal the explanation.
Short Explanation
A compensating control is like a spare tire: fine, as long as it actually gets you where you're going. So before you accept it or reject it, you check whether it really meets the same objective. The trap is taking the team's word for it, or ignoring the spare entirely.
Full Explanation
A compensating control is acceptable only when it addresses the same control objective and reduces risk to a comparable level as the control it replaces. The security manager should therefore evaluate the objective of the missing control, the risk it was meant to address, and whether the alternative control is designed and operating well enough to achieve that objective for the payments system. The outcome then supports a documented decision with audit and the risk owner. Accepting the team's explanation without evaluation closes the finding on assertion alone, which is not evidence, and may leave a real gap open. Ordering the original control regardless of the alternative ignores the possibility that the objective is already met and could waste resources on duplicate protection. Escalating straight to the board audit committee treats the issue as a confirmed significant failure before anyone knows whether a gap exists, and it bypasses the normal management response to audit findings. Exam caveat: if the evaluation shows a residual gap, the risk owner decides on further treatment or formal acceptance. Operational check: confirm the evaluation maps the compensating control to the original objective, includes evidence of operation, and is filed with the audit response.