[Verse 1] When the primary control just can't be done Budget cuts or tech that won't run Don't panic now, there's another way Compensating controls will save the day Look for alternatives that bridge the gap Multiple layers in your safety map [Chorus] When you can't prevent, then you detect When you can't detect, then you correct Triple C approach - Compensate, Control, Complete Same assurance level, different beat Document the why and how it works Equivalent protection, that's the perk [Verse 2] Scenario one - segregation fails One person handles all the sales Split the duties? Can't hire more staff Here's your compensating path Daily supervisor review Monthly reconciliation too Independent approval chain Same control goal you maintain [Chorus] When you can't prevent, then you detect When you can't detect, then you correct Triple C approach - Compensate, Control, Complete Same assurance level, different beat Document the why and how it works Equivalent protection, that's the perk [Verse 3] System access controls won't deploy IT budget frozen, can't enjoy Automated blocking off the table Manual logs keep you stable Real-time monitoring screens Exception reports and review teams Human oversight fills the space Technology controls can't replace [Bridge] Three elements make it strong Risk assessment proves it's not wrong Multiple touchpoints spread around Equivalent assurance can be found Document every single piece Show auditors your masterpiece [Verse 4] Third scenario brings the test Physical security at its best Can't install the cameras high Paper logs will satisfy Sign-in sheets and guard patrols Random checks achieve your goals Different method, same result Protection without the vault [Final Chorus] When you can't prevent, then you detect When you can't detect, then you correct Triple C approach - Compensate, Control, Complete Same assurance level, different beat Risk-based thinking shows the way Compensating controls save the day [Outro] Design with purpose, test with care Equivalent protection everywhere When primary fails, don't lose hope Compensating controls help you cope
← Exercise 4: Control Statement Writing | Key Standards and Frameworks →