Control design and selection: types, categories and control objectives

A control is any measure that modifies risk: a policy, process, device, practice or other action. A control objective is the statement of what the control must achieve, such as 'only authorized users can access payroll data'. Controls are selected to meet control objectives, which in turn come from the risk assessment and the organization's risk appetite. Starting with objectives keeps you from picking controls because they are familiar, fashionable or cheap, and it gives testers something clear to test against later.