CGOV.9:8 - Common Anti-Patterns and How to Avoid Them

• Completed checks stand in for controlled exposure. Follow the control’s action and consequence.
• Several approvals repeat one unverified input. Repair the shared source or dependence.
• Detection is called prevention. Compare the response time with the consequence being prevented.
• The auditor becomes the operator of the control. Keep management’s operation and independent assessment appropriately separated.