Selection and Development of Control Activities
Description
The entity selects and develops control activities that mitigate identified risks to the achievement of objectives — choosing controls proportionate to risk severity and business context.
⚠️ Risk Impact
Generic 'best practice' controls miss organisation-specific risk profiles. Controls that worked for the last vendor your CISO worked at may be misaligned to your business. Auditors test whether controls actually address the identified risks, not just whether they exist.
🔍 How EchelonGraph Detects This
EchelonGraph's Tier 1 Cloud Scanner automatically checks for this condition across all connected cloud accounts. Violations are flagged as medium-severity findings with remediation guidance.
🔧 Remediation
Maintain a control-to-risk mapping: every active control should be traceable to one or more identified risks (CC3.2 register). Conversely, every high/critical risk should map to at least one mitigating control. Periodic review tests both halves of the mapping.
💀 Real-World Attack Scenario
A company adopted '40 standard SOC 2 controls' from a template. The auditor traced each control back to the risk register and found that 11 controls were unused (no risk justified their existence), and 6 critical risks had no mitigating controls at all. The audit found CC5.1 deficient: 'controls were not selected based on entity-specific risk assessment'.
💰 Cost of Non-Compliance
Template-based controls without risk mapping: 38% of SOC 2 'qualified opinions' on CC5 (AICPA peer-review data). Reduces audit-defensibility and indicates security maturity issues to enterprise buyers.
📋 Audit Questions
- 1.For risk #X in the register, what controls mitigate it?
- 2.Show me a control whose existence isn't tied to a documented risk — why does it exist?
- 3.How is control selection reviewed annually?
- 4.What is the rationale for using this control vs an alternative?
⚡ Common Pitfalls
- ⛔Adopting a SOC 2 template wholesale without mapping controls to your actual risks
- ⛔Implementing the same control set across two products with materially different risk profiles
- ⛔No documentation of control rationale — when controls are challenged in audit, the team can't defend them
📈 Business Value
Risk-aligned control selection is the difference between mature security and security theatre. It produces controls that auditors find defensible and adversaries find difficult — rather than controls that look thorough on paper but miss the actual risk.
⏱️ Effort Estimate
12-20 hours annually for control-to-risk mapping review
EchelonGraph maintains the mapping continuously; flags controls without risk justification and risks without mitigating controls
🔗 Cross-Framework References
Automate SOC 2 CC5.1 compliance
EchelonGraph continuously monitors this control across all your cloud accounts.
Start Free →