What Is a Governance Control?
A governance control is a mechanism, process, or procedure designed to reduce the likelihood or impact of a risk, ensure compliance with obligations, and provide reasonable assurance that governance objectives are achieved. Controls are the operational building blocks of the governance framework.
Types of Controls
Controls are categorized by type: preventive (stop risks from occurring — e.g., access controls, approval workflows), detective (identify risks when they occur — e.g., monitoring, reconciliations, audits), and corrective (respond to risks after they occur — e.g., incident response, remediation plans). A robust control environment includes all three types working together.
Control Design vs. Operating Effectiveness
Control design effectiveness asks 'Is the control properly designed to mitigate the risk?' Operating effectiveness asks 'Is the control operating as designed, consistently, over time?' Both must be evaluated — a well-designed control that isn't consistently applied provides no assurance. Control testing evaluates both dimensions.
Manual vs. Automated Controls
Manual controls depend on people performing actions correctly (e.g., a manager reviewing and approving a report). Automated controls are built into systems (e.g., automated access revocation when an employee leaves). Automated controls are generally more reliable because they don't depend on individual compliance, but they require initial design and ongoing maintenance.
How MPG Supports Control Management
MPG provides a centralized control library with control descriptions, types, owners, effectiveness ratings, and links to the risks they mitigate. Control testing schedules, test results, and evidence are tracked within the platform. Controls are connected to risks, policies, compliance obligations, and assessment findings through the governance knowledge graph.
Key Takeaways
- Controls are the operational building blocks of the governance framework
- Three types: preventive, detective, and corrective — all are needed
- Both design effectiveness and operating effectiveness must be evaluated
- Automated controls are generally more reliable than manual controls
Frequently Asked Questions
How many controls do we need?
The number depends on your risk profile, regulatory requirements, and organizational complexity. The goal is not to maximize controls but to have the right controls — those that effectively mitigate material risks without creating unnecessary bureaucracy. MPG helps by linking controls to risks so you can identify gaps and redundancies.
What is a key control?
A key control is one that is critical to mitigating a material risk — its failure could significantly impact the organization. Key controls receive priority in testing, monitoring, and reporting. MPG allows you to flag key controls and track them with enhanced oversight.