QULDEXResources · Glossary
What is a control in audit and compliance?
What does a control mean in an audit?
A control exists because of a risk or a requirement. 'Review user access every quarter' is a control; the risk is that people keep access they no longer need.
A good control statement says who does what, how often, and what record it leaves. Without the record, an auditor cannot confirm the control worked, however sound it is.
What are the types of control?
Stops a problem from happening. Example: multi-factor authentication.
Finds a problem that has happened. Example: a log alert or an access review.
Limits the damage and restores normal operation. Example: restoring from backup.
What does a well-written control look like?
A control for removing access when people leave.
| Item | What it looks like |
|---|---|
| Statement | IT operations disables all accounts of a leaver on their last working day. |
| Risk addressed | Former staff keep access to systems and data. |
| Type | Preventive |
| Owner | IT operations lead |
| Evidence | Leaver ticket with the time each account was disabled |
This is an illustration written for this page, not a customer record.
How do frameworks organise controls?
| Framework | Where | What it asks for |
|---|---|---|
| ISO 27001 | Annex A | 93 controls in four themes: organisational, people, physical and technological. You select those your risks need. |
| SOC 2 | CC5 | Control activities are selected and developed to mitigate risks, then deployed through policies and procedures. |
| NIST 800-53 | Rev. 5 | A catalogue of security and privacy controls arranged in 20 families. |
| NIST CSF 2.0 | Protect, Detect | Outcomes rather than controls; you choose controls that achieve each outcome. |
References are to the current editions listed under Sources. Check the edition your auditor is using.
What makes a control weak?
No frequency
'Access is reviewed' does not say how often, so it cannot be tested.
Instead: state who does it and how often.
No evidence
The control runs but leaves nothing behind.
Instead: decide the record the control produces before it starts.
Copied, not chosen
Controls taken from a template address risks you do not have.
Instead: tie each control to a risk or a requirement.
How does QULDEX handle this?
Controls arrive already mapped across frameworks, each with an owner and a status.
Control: common questions
What is the difference between a control and a policy?
A policy states what the organisation intends. A control is a specific measure that carries the policy out and can be tested.
How many controls does ISO 27001 have?
Annex A of ISO/IEC 27001:2022 lists 93 controls. You do not have to implement all of them, but you must consider each one and justify your choices in the Statement of Applicability.
What is a compensating control?
An alternative measure used when the expected control cannot be applied. It must address the same risk to a comparable degree, and the reason should be documented.
Sources
- ISO/IEC 27001:2022, Information security management systems: Requirements
- ISO/IEC 27002:2022, Information security controls
- NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations
- AICPA, 2017 Trust Services Criteria (with revised points of focus, 2022). aicpa-cima.com
Every control with an owner, a status and its evidence
Controls, evidence, findings and corrective actions in one audit workspace.