View source for Principle 10 - Design Control Activities

== 10.0 Design Control Activities ==
[https://guides.gaoinnovations.gov/greenbook/2025/principle-10-design-control-activities/ External Link to US GAO Green Book Principle 10]

=== Overview ===

==== <span id="10.01"></span>'''10.01''' ====
Management should design control activities to mitigate risks to achieving the entity’s objectives to acceptable levels.

=== <span id="10.1"></span>10.1 Response to Risks ===

==== <span id="10.02"></span>'''10.02''' ====
Management designs control activities in response to risks to achieve an effective internal control system. Control activities are the actions management establishes through policies and procedures to specifically mitigate risks to achieving the entity’s objectives to acceptable levels. Control activities support all the components of internal control but are particularly aligned with the risk assessment component. As part of periodic and ongoing risk assessments, management identifies objectives; the risks related to the entity and its objectives, including its service organizations; the entity’s risk tolerance; and risk responses. Management designs control activities or modifies existing control activities to mitigate risks to acceptable levels within management’s defined risk tolerance. Typically, control activities are needed when an entity chooses to either reduce or share a risk. The nature and extent of the risk response and any associated control activities will depend, at least in part, on management’s defined risk tolerance.

=== <span id="10.2"></span>10.2 Design of Appropriate Types of Control Activities ===

==== <span id="10.03"></span>'''10.03''' ====
Management designs appropriate types of control activities for the entity’s internal control system, including the entity’s information technology, by considering all aspects of its internal control components, relevant business processes, and operating environment. An entity’s internal control is flexible to allow management to tailor control activities to meet the entity’s unique needs. The specific control activities used by a given entity may be different from those used by others based on several factors. These factors could include specific threats the entity faces and the risks involved, differences in objectives, managerial judgment, size and complexity of the entity, operational environment, and sensitivity and value of data.

==== <span id="10.04"></span>'''10.04''' ====
The common categories of control activities listed in table 1 [omitted] illustrate the range and variety of control activities that may be useful to management. 

The list is not all inclusive and may not include all categories of control activities that an entity may need.

(ADD TABLE)

=== <span id="10.3"></span>10.3 Design of Automated and Manual Control Activities ===

==== <span id="10.05"></span>'''10.05''' ====
Control activities can be designed and implemented in an automated, partially automated, or a manual manner. Automated control activities may be wholly or partially performed using the entity’s information technology. Manual control activities are performed by individuals without relying on the entity’s information technology. Automated control activities tend to be more reliable because they are less susceptible to human error and are typically more efficient.

==== <span id="10.06"></span>'''10.06''' ====
Management designs information technology control activities to support the operation and security of the entity’s information technology and automated business processes. Information technology control activities consist of general, application, and user control activities.

==== <span id="10.07"></span>'''10.07''' ====
Application and user control activities rely on the entity’s information technology. Application control activities are automated control activities that are incorporated directly into application software to achieve the completeness, accuracy, and validity of transactions and data. Application control activities include control activities over the input, processing, and output of data. User control activities, sometimes referred to as information technology-dependent controls, are partially automated control activities that are performed by individuals using the entity’s information technology or by relying on the information processed through technology. For example, management may authorize a transaction as part of an automated workflow or may respond to incidents flagged in system log reports.

==== <span id="10.08"></span>'''10.08''' ====
General control activities are designed to mitigate information security risks and are the actions established through policies and procedures that apply to all or a large segment of an entity’s information technology. General control activities support the proper operation of the entity’s information technology by creating a suitable environment for effective operation of application and user control activities. General control activities can be designed and implemented in either an automated or a manual manner.

==== <span id="10.09"></span>'''10.09''' ====
Common categories of information technology control activities and how they align with information processing and information security objectives are illustrated in figure 7. The common categories of information technology control activities listed in figure 7 are meant only to illustrate the range and variety of control activities that may be useful to management. This list is not all inclusive and may not include all information technology control activities that an entity may need.

(FIGURE 7)

=== <span id="10.4"></span>10.4 Design of Preventive and Detective Control Activities ===

==== <span id="10.10"></span>'''10.10''' ====
Control activities can be either preventive or detective. The main difference between preventive and detective control activities is timing, that is, when the control activity occurs within an entity’s operations. A preventive control activity is designed to avoid an unintended event or result before it occurs. A detective control activity is designed to discover and timely correct an unintended event or result after it occurs. The effectiveness of a detective control activity depends on timeliness of the corrective action to address the unintended event or result. Corrective action may address the event that occurred or may correct the deficiencies in the process that led to the event.

==== <span id="10.11"></span>'''10.11''' ====
Management evaluates the purpose of the control activity as well as the likelihood of an unintended event or result occurring and the magnitude of impact it would have on the entity in achieving its objectives. Management may design both preventive and detective control activities to effectively mitigate the risks to achieving the objectives, particularly in circumstances where the risk of an unintended event or result occurring is high. Generally, the higher the risk of an unintended event or result occurring, the stronger or more robust the control activities need to be to effectively mitigate the higher risk to acceptable levels.

==== <span id="10.12"></span>'''10.12''' ====
Management designs an appropriate mix of preventive and detective control activities to mitigate risks to an acceptable level, prioritizing preventive control activities where appropriate. When designing control activities, management first considers preventive control activities, as they generally offer the most cost-efficient use of resources and are generally effective at mitigating fraud and improper payment risks. Management next considers detective control activities and may design both preventive and detective control activities when necessary to mitigate a particular risk.

==== <span id="10.13"></span>'''10.13''' ====
There may be rare situations where management determines through its evaluation that a preventive control activity would better mitigate a particular risk but is unable to implement it. In these situations, management strengthens and expedites detective control activities and may also expedite monitoring activities to enable the entity to effectively mitigate the risk to acceptable levels, considering the risk related to the likelihood of an unintended event or result occurring and the magnitude of impact it would have on the entity in achieving its objectives.

=== <span id="10.5"></span>10.5 Design of Control Activities at Various Levels ===

==== <span id="10.14"></span>'''10.14''' ====
Management designs control activities at the appropriate levels in the organizational structure.

==== <span id="10.15"></span>'''10.15''' ====
Management designs control activities for appropriate mitigation of risks in the entity’s business processes. Business processes transform inputs into outputs through a series of transactions or activities to achieve the entity’s objectives. Management designs entity-level control activities, business process-level control activities (commonly referred to as transaction control activities), or both depending on the level of precision needed so that the entity mitigates risks to an acceptable level related to its business processes. Entity-level and transaction control activities can be implemented in an automated, partially automated, or a manual manner.

==== <span id="10.16"></span>'''10.16''' ====
Entity-level control activities are controls designed to mitigate risks that have a pervasive effect on an entity’s internal control system and may pertain to multiple components. Entity-level control activities may include controls related to the entity’s risk assessment process, control environment, service organizations, management override, and performance or analytical reviews.

==== <span id="10.17"></span>'''10.17''' ====
Transaction control activities are controls that directly mitigate information processing risks in the entity’s business processes. The term transaction tends to be associated with business processes addressing reporting objectives (e.g., financial transactions), while the term activity is more often associated with business processes addressing operations or compliance objectives. In the Green Book, “transactions” and “transaction control activities” can cover both transactions and activities. Management may design a variety of transaction control activities for business processes, which may include verifications, reconciliations, authorizations and approvals, physical control activities, and supervisory control activities.

==== <span id="10.18"></span>'''10.18''' ====
When designing transaction control activities, management evaluates information processing objectives to meet the entity’s objectives and mitigate related risks.

Information processing objectives may include the following:

* Completeness - All transactions and events that occur have been properly recorded.
* Accuracy - Data relating to transactions and events are properly and timely recorded.
* Validity - All recorded transactions and events actually occurred, are related to the entity, and were executed according to prescribed procedures.

==== <span id="10.19"></span>'''10.19''' ====
While the information processing objectives are most often associated with financial processes and transactions, information processing objectives can be applied to any activity in an organization. For example, information processing objectives and related control activities can be applied to management’s decision-making processes that use non-financial data.

==== <span id="10.20"></span>'''10.20''' ====
When designing entity-level and transaction control activities, management evaluates the level of precision needed for the business processes to meet the entity’s objectives and mitigate related risks. The precision of a control activity refers to how exact the control activity will be in preventing or detecting an unintended event or result. Control activity precision is closely linked to the entity’s risk tolerance for a particular objective; a lower risk tolerance will require a more precise control activity. In determining the necessary level of precision for a control activity, management evaluates the following:

* '''Level of aggregation''' - A control activity that is performed at a more granular level generally is more precise than one performed at a higher level. For example, an analysis of obligations by budget object class normally is more precise than an analysis of total obligations for the entity.
* '''Consistency and timing of performance''' - A control activity that is performed routinely, consistently, and timely generally is more precise than one performed sporadically.
* '''Correlation to relevant business processes''' - A control activity that is directly related to a business process generally is more likely to prevent or detect and correct an error than a control activity that is only indirectly related.

=== <span id="10.6"></span>10.6 Segregation of Duties ===

==== <span id="10.21"></span>'''10.21''' ====
Management considers segregation of duties in designing control activities so that incompatible duties are segregated. Where such segregation is not practical, management designs alternative control activities to mitigate the risk.

==== <span id="10.22"></span>'''10.22''' ====
Segregation of duties helps prevent fraud, waste, and abuse in the internal control system. Management considers the need to separate control activities related to authority, custody, and accounting of operations to achieve adequate segregation of duties within the entity’s business processes. Segregation of duties can mitigate the risk of management override. Management override circumvents existing control activities and increases risk of fraud, waste, and abuse. Management mitigates this risk through segregation of duties but cannot absolutely prevent it because of the risk of collusion, where two or more employees act together to commit fraud, waste, or abuse.

==== <span id="10.23"></span>'''10.23''' ====
If segregation of duties is not practical within a business process because of limited personnel or other factors, management designs alternative control activities to mitigate the risk of fraud, waste, or abuse in the business process.

{{Principles}}

== Related Story Events ==

* [[2020: The Event|🗳️ 2020: The Event]]
* [[May 15, 2025: Let's Play Hot Potato|🥔 May 2025: PRR Issues]]