Which factor best predicts the effectiveness of risk controls?

• A. The existence of controls only.
• B. The alignment of controls with business objectives and regular testing results, audits, and KRIs.
• C. The number of policies on the shelf.
• D. The annual revenue growth rate.

Answer: (B)

The key idea is that how well risk controls work depends on them being tied to what the organization is trying to achieve and how they are continually checked. When controls are designed to support important business objectives, they address the real risks that could derail those goals. But that alignment isn’t enough by itself—you need ongoing evidence that the controls are actually performing as intended. Regular testing shows whether controls operate correctly, audits provide independent verification of both design and effectiveness, and KRIs (Key Risk Indicators) give ongoing signals about risk levels and control performance. Together, these elements create a living picture of control effectiveness: strong alignment plus consistent testing, audits, and monitoring suggests effective controls; gaps in any of these areas point to potential weaknesses.

Explanations that focus only on having controls, or on how many policies exist, don’t guarantee effectiveness—policies can sit on shelves without being implemented or tested. And metrics like annual revenue growth don’t directly measure how well controls mitigate risk.