CRISC Certified in Risk and Information Systems ControlRisk Response and ReportingHard
An organization is evaluating the effectiveness of its control environment for financial reporting. A recent audit revealed several instances where journal entries were posted without proper managerial approval, leading to minor financial discrepancies. The risk practitioner recommends implementing a workflow system that digitally routes all journal entries to the appropriate manager for approval before posting. This is an example of improving which aspect of control effectiveness?
- AControl efficiency
- BControl documentation
- CControl monitoring
- DControl design
Show answer & explanationAnswer & explanation
Correct answer: D. Control design
The issue is that entries were posted 'without proper managerial approval,' indicating a weakness in how the control was structured or put in place. Implementing a workflow system to enforce approval *before* posting directly modifies and improves the *design* of the control to ensure it operates as intended.
Why the other options are wrong
- A. Control efficiency relates to how economically the control operates, not its ability to prevent errors, which is the core issue here.
- B. Control documentation records how controls are designed and operate; while important, it's not the primary action of implementing a new workflow system to enforce approval.
- C. Control monitoring assesses if existing controls are working; this recommendation is about changing the control itself, not just watching it.
Control Design Effectiveness
The degree to which a control, if operating as prescribed, is capable of preventing or detecting a material misstatement or breakdown in achieving a control objective.
- Focuses on the structure and logic of the control.
- Evaluates if the control is properly conceived.
- Distinguishes from operational effectiveness (how it actually works).
Memory trick: Design, Implement, Monitor, Document (DIMD) for effective controls.