A policy requires monthly review of privileged access, and the procedure is well documented and appropriate. Sample testing shows that no reviews have been performed for the last five months. How should this deficiency be classified?

Control deficiencies fall into two categories. A design deficiency exists when a control, even if performed exactly as documented, would not achieve its objective. An operating effectiveness deficiency exists when a properly designed control is not performed as intended, is performed inconsistently or is performed by someone without the competence or authority to do it. Here the procedure is documented and appropriate, so the design is sound; the failure is that the review has not been performed for five months, which is a classic operating effectiveness deficiency. Calling it a design deficiency would lead to rewriting a procedure that is not the problem. Inherent risk describes the level of risk before controls are considered; it is not a classification of a control failure. Treating the situation as an accepted risk confuses approval of a procedure with a formal decision to accept residual risk, and no risk owner has accepted the consequences of reviews not happening. Exam caveat: repeated operating failures can point to a design issue, such as no assigned owner or no reminder, which root-cause analysis should check. Operational check: confirm the control has a named owner, a schedule and retained evidence, and retest a sample after remediation.