Internal Controls Design and Effectiveness Testing Questions

How to design controls and prove they work. Covers control objectives, preventive vs detective vs corrective vs compensating controls and what makes a compensating control legitimate, building and maintaining a control matrix that maps controls to risks, owners and requirements, control ownership and segregation of duties, the COSO internal control framework, entity-level vs process-level controls, the three lines of defence, design-effectiveness vs operating-effectiveness testing, choosing test methods, test cadence and re-tests, sampling and interpreting exceptions, control self-assessment, judging whether controls are improving or decaying over time, evaluating control deficiencies and their severity, reliance on IT general controls, retiring, consolidating or automating controls without losing coverage, control changes in a cloud migration, and corrective and preventive action when a control fails. Applies to security, IT and compliance controls, including the IT general controls that support financial reporting, at the level of the control discipline itself. Excludes finance-process controls (payables, reconciliations, month-end close), the technical mechanics of any one security tool or attack technique, the content of specific certification frameworks, audit logistics and evidence handling, and compliance tooling and automation.