When a Primary Control Cannot Be Relied On
A control may be unavailable for a period because of a system conversion, a practical process constraint, or another unavoidable condition. The related risk does not disappear while the primary control is unavailable. A compensating control is a different control intended to address the same risk during that gap. The key question is not whether another activity exists, but whether it provides sufficiently independent, complete, timely, and verifiable protection.
For example, a post-transaction review may help compensate when an approval step before payment is unavailable. But it is not automatically equivalent: it may miss transactions, find errors only after funds are unrecoverable, or rely on the same defective data as the primary control. The assessment must connect the backup activity to the specific risk and to the time at which harm could occur. This approach is aligned with the CAS Exam 9 (Risk Management for Actuaries) syllabus.
A sound assessment examines four dimensions: independence, coverage, timing, and evidence. These are related but not interchangeable. Excellent documentation cannot make a late review timely, and a review of every transaction cannot make an unreliable data feed independent.
Four Tests for Adequacy
Independence. Ask whether the compensating control can detect the same failure that defeated the primary control. Independence is not established just because a different employee signs a review. Consider whether the reviewer has suitable authority and competence, whether the reviewer is separate from the transaction’s preparation and approval, and whether the information source could share the primary control’s failure. Shared staff, access rights, system logic, or data feeds can create a common point of failure.
Coverage. Define the population that is exposed to the relevant risk, then determine which items the compensating control actually examines. State exclusions explicitly. Reviewing every item on a filtered report is not full coverage if the filter omits transactions that could also be affected. Counts are useful, but they can conceal the omission of a small number of unusually material or vulnerable items.
For a defined population of \(N\) relevant items, suppose the control examines \(C\) of them, with each item counted once. The transaction coverage rate is \(C/N\), and the uncovered proportion is \((N-C)/N\). These measures follow because the population divides into checked and unchecked items: \(N=C+(N-C)\). Dividing each part by \(N\) gives \(1=C/N+(N-C)/N\). The calculation describes transaction counts only; if some items are much riskier than others, assess their coverage separately.
Timing. Compare when the control detects an issue and when the responsible person can act with the point at which the harm occurs or becomes difficult to reverse. A review after an event can still be useful if meaningful intervention remains possible. Conversely, a daily review may be too late if funds become irrecoverable within hours. Include the response time, not just the time needed to perform the review.
Evidence. Determine whether the control leaves a reliable record of what was examined, by whom, when, against what criteria, and how exceptions were resolved. Evidence should support the claimed population and the review performed. A sign-off without a retained population, review results, or exception trail is weak evidence. Missing evidence does not prove that no control activity occurred, but it prevents a reviewer from relying confidently on the claimed operation.
A Practical Assessment Sequence
Name the event the primary control is meant to prevent or detect, and specify when or where that control cannot be relied on.
Describe its owner, inputs, review criteria, escalation route, and available action. A vague activity such as “management monitors the process” is not enough to evaluate.
Check independence, coverage of the relevant population and risk events, timing of detection and response, and the quality of evidence.
State whether the control is adequate for the defined gap, what remains uncovered, and what condition must be met before reliance is justified.
There is no universal percentage at which a compensating control becomes adequate. A high coverage rate can still be inadequate if the omitted items include the most consequential exposures or if the review is too late to permit action. A lower rate may be more informative if the excluded population is demonstrably outside the relevant risk, but the exclusion must be justified and evidenced.
Worked Example: Reviewing Payments During an Approval-System Outage
A hypothetical insurer’s second-approver control is unavailable for one business week. Its intended purpose is to prevent payment to an unauthorized bank account. As a temporary measure, an independent finance team compares a settlement file with approved payment instructions on the next business day. Assume that 480 payments are made during the week, the report contains only payments above $2,000, and the settlement file is independently obtained from the bank. A separate investigation identifies eight unauthorized payments in the full population: five exceed $2,000 and three do not. A payment can be recalled only within four hours; the team completes its review about one business day later.
Method. Compare the temporary review with the same unauthorized-payment risk, and assess the four dimensions separately. Assume that the finance team reviews every item appearing on the report and records its review.
Independence. The team is separate from payment preparation, and its settlement file comes directly from the bank rather than from the payment system that lacked the approval control. Those facts support independence from the primary control’s failure. They do not, by themselves, establish adequate coverage or timing.
Coverage. The report contains 72 payments. Its transaction coverage is \(72/480=0.15\), or 15.00%; the remaining \(480-72=408\) payments are outside the review. For the known risk events, the review includes five of the eight unauthorized payments: \(5/8=0.625\), or 62.50%. It therefore excludes \(8-5=3\) known unauthorized payments. The transaction percentage and risk-event percentage answer different questions, and neither supports a claim of full coverage.
Timing and evidence. The team’s next-business-day review occurs after the four-hour recall window, so it cannot support timely recall under the stated process. The retained report and sign-off show that the 72 reported payments were reviewed, but they do not establish review of the 408 excluded payments.
Conclusion and mistake avoided. The temporary control is not an adequate substitute for the approval control as described: it omits relevant payments and acts after the stated recovery window. A common mistake is to say “coverage is 100% because the team reviewed every item on its report.” That uses the report, rather than the 480 relevant payments, as the denominator. The corrected transaction coverage is \(72/480=15.00\%\), and the known risk-event coverage is \(5/8=62.50\%\).
Worked Example: Referral Review Before Policy Inception
A hypothetical insurer’s referral-approval workflow is unavailable for a month. A separate quality unit reviews a daily report of proposed policies with exposure above $1 million. There are 40 policies requiring referral during the month, but the report contains 38; the other two are omitted by a feed problem. The reviewer examines all 38 the next business day. Six lack the required referral approval: five are resolved before coverage begins, while one remains unresolved when coverage begins. Assume the policies begin coverage three business days after submission, and assume the unit is not involved in underwriting decisions.
Method. Assess whether the post-submission review can identify the missing approval early enough to support action before coverage begins. Treat all 40 policies as the relevant population because each required referral.
Independence and coverage. The separate quality unit supports organizational independence from underwriting decisions. Coverage is \(38/40=0.95\), or 95.00%, leaving \(40-38=2\) policies unchecked. Within the 38 reviewed policies, \(6/38=0.1579\), or 15.79%, lack approval. This exception rate is not a coverage rate: it describes exceptions found among reviewed items, not the proportion of the full population examined.
Timing. Five of the six identified exceptions are resolved before coverage begins, so \(5/6=0.8333\), or 83.33%, of those exceptions are resolved in time. One remains unresolved at inception. The three-business-day interval makes next-business-day review potentially useful, but it does not make the unresolved exception acceptable.
Evidence and conclusion. The daily report and documented review can support the operation of the review for the 38 listed policies. They cannot support coverage of the two omitted policies; the feed issue must be addressed or independently reconciled. On these facts, the control is not an adequate full substitute for the referral approval workflow. It has useful independent review and sufficient time for most identified cases, but it leaves two policies unchecked and one identified referral unresolved at inception.
Mistake avoided. Do not conclude “adequate” solely because the reviewer found and resolved five exceptions. A compensating control must be assessed against the complete relevant population and the required action point, not just the cases that it happened to capture.
Worked Example: Emergency Privileged-Access Changes
A hypothetical insurer has an emergency process for privileged-access changes because the usual pre-approval control is unavailable during a system migration. A security team independent of system administrators reviews access logs each day. In a month, there are 60 privileged changes. The log supports review of 57 changes: 54 are reviewed within 24 hours, three are reviewed after 72 hours, and three have no review evidence. Assume that an unauthorized change can be exploited within 48 hours. Also assume that the log is produced by the same system whose access changes are being reviewed, and no independent reconciliation of the log population is performed.
Method. Compare the review’s coverage and timing with the complete set of changes and the 48-hour exploitation window. Assess whether the evidence source could omit the very activity under review.
Independence. The security team’s separation from system administration is a strength. However, the review relies on the same system’s log, with no independent check that all 60 changes are represented. The reviewer’s organizational independence therefore does not establish independence of the information used.
Coverage and timing. Evidence supports review of \(57/60=0.95\), or 95.00%, of changes. The evidence-supported timely review rate is \(54/60=0.90\), or 90.00%. Of the 57 reviewed changes, \(54/57=0.9474\), or 94.74%, were reviewed within 24 hours. The distinction matters: the 95.00% rate includes three reviews that occurred after the 48-hour exploitation window, while the 90.00% rate uses all 60 changes as its denominator and counts only evidenced reviews completed within 24 hours.
Evidence and conclusion. The log and review records support the 57 documented reviews, but three changes have no review evidence, and the log population is not independently reconciled. The control is not adequate as described: three changes lack evidence of review, three more were reviewed after the stated exploitation window, and the completeness of the source is unverified.
Mistake avoided. Reporting only “57 of 57 documented changes were reviewed” would use an incomplete evidence set as the denominator. The stated population is 60 changes, so the relevant timely, evidenced proportion is \(54/60=90.00\%\), subject to the additional limitation that the log itself may be incomplete.
Common Assessment Traps
- Confusing a different control with an independent control. A different reviewer may still rely on the same incomplete data or have the same conflicting responsibility.
- Using the wrong denominator. Measure against the relevant exposure population, not only the items that appear on a report or have documentation.
- Calling a control timely because it operates frequently. Daily review is not timely if the harm becomes irreversible sooner than the review and response can occur.
- Treating sign-off as proof of substance. Evidence should show the population, criteria, review, and resolution of exceptions, not merely that someone approved a checklist.
- Combining strengths into an unsupported score. A strong result on one dimension does not cancel a critical weakness on another. Explain the dimensions and their consequences rather than averaging them into a single unqualified rating.
Check Your Understanding
For each case, assess the control using the relevant population, independence, timing, and evidence. Treat the stated facts as complete.
- A hypothetical insurer reviews 90 of 100 urgent claim payments after release. All 90 are checked by a separate team within one day, but funds become unrecoverable after two hours. What are transaction coverage and the principal adequacy concern? (Answer: 90/100 = 90.00%; the review is too late for recovery under the stated two-hour window.)
- A backup review checks 48 of 50 required vendor changes. Two are omitted from its report. Of the 48 reviewed, three exceptions are found, and all three are corrected before use. What is transaction coverage, and does the successful correction of the three exceptions establish full coverage? (Answer: 48/50 = 96.00%; no, two relevant changes remain unchecked.)
- A separate compliance analyst reviews all 75 changes within 12 hours, but relies on the same system log that feeds the primary approval control. No independent log reconciliation exists. Identify one strength and the main independence limitation. (Answer: Timely review of all 75 is a strength; completeness of the shared log is unverified, so the information source may share a failure.)
- A daily review covers 30 of 32 high-risk submissions. The two exclusions are below the report threshold, but both still require approval. The 30 reviewed items have complete reviewer notes; harm can occur before the next daily review. State two distinct reasons the control is inadequate. (Answer: It omits two submissions that still require approval, and daily detection may occur after harm; complete notes for the 30 do not resolve either issue.)
- A hypothetical access review has evidence for 46 of 50 changes. Of those 46, 40 are checked within 24 hours and six after 48 hours. The risk can materialize within 36 hours. Calculate the evidenced timely proportion using all changes as the denominator and identify the timing issue. (Answer: 40/50 = 80.00%; six evidenced reviews occur after the 36-hour risk window, and four changes have no review evidence.)