CGOV.9:3 - Forces
Controls should improve the prospect of achieving an objective while preserving useful work. Earlier prevention may reduce exposure but impede operations; later detection can be cheaper while allowing an irreversible loss. Separation of duties can help but may exceed a small team’s available capacity.
Some controls are required by applicable rules. Others are design choices. Their present force, practical effectiveness and justification are separate questions; criticizing a requirement does not amend it.