Where circumstances do not permit implementing ideal controls, an organization should put in place the...

TheInternal Controlstopic in the IOFM APS Certification Program covers the design and implementation of internal controls to mitigate risks. When ideal controls (e.g., full segregation of duties) are not feasible due to resource constraints or organizational structure,compensating controlsare implemented as alternative measures to achieve similar risk mitigation. These controlsprovide additional checks or oversight to compensate for the absence of primary controls.

Option A (Interim controls): Interim controls imply temporary measures, not necessarily designed to compensate for missing ideal controls. This is incorrect.

Option B (Stop-gap controls): Stop-gap controls are ad-hoc, temporary fixes, not a formal term in the COSO framework or AP practices. This is incorrect.

Option C (Secondary controls): Secondary controls are not a recognized term in internal control frameworks; they imply less critical controls, not alternatives. This is incorrect.

Option D (Compensating controls): Correct. Compensating controls are alternative measures implemented when ideal controls are not practical, ensuring adequate risk mitigation.

Reference to IOFM APS Documents: The APS e-textbook underInternal Controlsstates, “When ideal controls cannot be implemented, compensating controls provide alternative risk mitigation, such as additional reviews or approvals to address control gaps.” The training video discusses compensating controls in the context of COSO and SOX, noting their use in small organizations where segregation of duties is challenging.