Exam CS0-003 topic 1 question 191 discussion

The Chief Information Security Officer (CISO) implemented: B. Compensating controls. Compensating controls are alternative measures put in place when primary controls are not feasible or sufficient to mitigate risks adequately. In this scenario, due to staffing limitations, the small company cannot effectively segregate duties to prevent errors and fraud in payroll management. Therefore, the CISO chose to implement compensating controls by maintaining and reviewing logs and audit trails. These controls help mitigate the risk of errors and fraud by providing oversight and accountability, even in the absence of traditional segregation of duties.

B. Compensating controls Explanation: Compensating controls are alternative measures put in place when primary controls are deemed insufficient. In this case, the lack of segregation of duties is compensated for by maintaining and reviewing logs and audit trails to mitigate the risk of error and fraud in payroll management.