What is the difference between a control and a control objective?

• A. A control objective is a mechanism to reduce risk; a control states what the control is intended to achieve.
• B. A control is a mechanism to reduce risk; a control objective states what the control is intended to achieve.
• C. A control objective is the measurement of risk.
• D. A control is the same as the risk appetite.

Answer: (B)

The difference hinges on what each term aims to accomplish. A control is the mechanism you put in place to reduce risk—such as a policy, process, or technical safeguard. The control objective, on the other hand, states what the control is intended to achieve—the specific outcome or risk to be prevented or mitigated. For example, a multi-factor authentication control exists to reduce unauthorized access, and its objective is to ensure that only authorized users can access systems. This clarifies why the other ideas don’t fit: the objective is not the mechanism itself, nor is it a measurement of risk, and a control is not the same as the organization’s risk appetite.