How can you measure the effectiveness of risk controls?

• A. Through the number of controls created.
• B. By subjective manager opinion.
• C. Through control design adequacy, testing results, audit findings, and performance of KRIs.
• D. By the size of the budget for risk management.

Answer: (C)

Measuring effectiveness of risk controls relies on evidence that the controls are properly designed, actually operate as intended, and meaningfully reduce risk. The best approach combines design adequacy, testing results, audit findings, and the performance of KRIs. Design adequacy confirms the control is appropriate for the risk and correctly specified. Testing results show that the control functions effectively in practice. Audit findings provide independent validation and identify any deficiencies and remediation progress. KRIs track ongoing risk levels and how well the control keeps risk within acceptable limits. Together, these elements give a robust, objective view of how well the controls are working, rather than just counting how many controls exist, relying on a subjective opinion, or judging by the risk management budget.