Day 1: From Risk to Control Design

Control Objectives and Process Risks

• Define assets requiring protection or assurance
• Connect risks with occurrence points
• Identify conditions increasing risk likelihood
• Build risk map for selected process

Control Types and the Right Mix

• Use prevention where events are stoppable
• Use detection where prevention is incomplete
• Define corrective controls after deviations
• Compare control mixes for identical risks

Segregation of Duties and Authority

• Separate initiation approval custody and review
• Identify conflicting access rights within systems
• Design compensating controls for smaller teams
• Analyze case involving combined incompatible authority

Day 2: Documentation, Automation, and Effectiveness Testing

Control Description and Operating Evidence

• Document control performer, timing, method
• Define permitted exceptions and approval routes
• Avoid descriptions that cannot be tested
• Edit complete and testable control card

Automated and Technology Controls

• Choose automation reducing repeated manual errors
• Identify system, data, and rule dependencies
• Consider change access and privileged-user controls
• Evaluate a simplified automated-control scenario

Testing Design and Operation

• Assess whether controls prevent/detect risks
• Select sample sizes/periods matching frequency
• Define evidence demonstrating operation as designed
• Perform and document a control test

Day 3: Control Simplification and Gap Remediation

Excess Controls and Friction

• Measure approval effects on transaction time
• Identify controls duplicating purpose without value
• Combine/remove activities not reducing exposure
• Redesign an over-controlled process

Control Gaps and Residual Risk

• Estimate how control weakness changes exposure
• Choose temporary safeguards before permanent correction
• Prioritize gaps according to risk magnitude
• Prepare a control-remediation plan

Monitoring System Effectiveness

• Select failure and override indicators
• Track recurring exceptions and their causes
• Reassess design after material process change
• Build a dashboard for critical controls

• Process maps connecting risks with actual control points
• Manual automated and compensating control design exercises
• Sample-based tests separating design from operation
• A simplification workshop reducing unnecessary control burden