Question

A risk manager is designing a monitoring program for a payment processing system that has more than 40 documented controls. Resource constraints prevent continuous monitoring of every control. To provide the most meaningful assurance to management with limited resources, which approach should the risk manager prioritize?

Accepted Answer

Monitor the key controls that most directly mitigate the highest-rated risks to the payment process

Answer

Monitor an equal sample of controls from every process area to ensure balanced coverage

Answer

Monitor the controls that are least expensive and quickest to test each cycle

Answer

Monitor only the controls that failed during the most recent internal audit