CGOV.9:4.2 - Choose a useful control and response

For each important exposure, determine what action would prevent it, detect it soon enough or limit and correct its consequences. Name who performs the action, what information it uses and what happens when it identifies an exception.

Compare credible alternatives, including a sufficient existing control and a narrower correction. Consider the likely reduction in exposure alongside staffing, access, delay, false alarms, displaced work and maintenance. Remove a discretionary duplicate that adds no useful protection or information.

Where duties should be separated, check the actual access and influence. Two names on a chart do not provide separation if the same person can approve both steps. When separation is impractical, identify an allowed alternative and the exposure it leaves. If an applicable rule requires separation, a cheaper alternative needs the appropriate authorized change before it can replace that requirement.