Security & GRC

What is Mitigating Control?

A compensating control assigned to an accepted SoD risk, such as a periodic review of transactions.

When conflicts cannot be removed, mitigating controls reduce risk. They require owners and evidence of execution. Auditors test that controls are actually performed.