Compensating Controls

As described by the American Institute of Certified Public Accountants (AICPA), "Some organizations, by virtue of their size, are not able to implement basic controls such as segregation of duties. In these cases, it is important that management institute compensating controls to cover for the lack of a basic control, or if a basic control is not able to function for some period of time." 

This is an important category of controls that is often over looked when internal control deficiencies are identified by either internal or external auditors.  There are many different forms of compensating controls but few organizations have formally defined what the compensating controls could potentially be for each control.  This can be a valuable reference as well as a potential cost savings in the audit process when a control is more expensive to implement and test that it's compensating control counterpart.