Control processes are the procedures and activities that aim to ensure the effectiveness and efficiency of the organization’s operations, the reliability of its information, and the compliance with its policies and regulations12.
The ongoing efficiency of control processes is the degree to which the control processes achieve their intended results with minimum resources, costs, or waste34.
The best way to determine the ongoing efficiency of control processes is to analyze key performance indicators (KPIs), which are quantifiable measures of progress toward an intended result, such as a strategic objective or a desired outcome56.
Analyzing KPIs is the best way because it provides a systematic and consistent method of evaluating the performance of the control processes, and identifying the areas of improvement or optimization56.
Analyzing KPIs is also the best way because it enables the organization to monitor and report the efficiency of the control processes to the relevant stakeholders, and to take corrective or preventive actions when necessary56.
The other options are not the best way, but rather possible sources of information or inputs that may support or complement the analysis of KPIs. For example:
Performing annual risk assessments is a way to identify and evaluate the risks that may affect the organization’s objectives, and to determine the adequacy and effectiveness ofthe control processes in mitigating those risks12. However, this way is not the best because it is periodic rather than continuous, and may not capture the changes or trends in the efficiency of the control processes12.
Interviewing process owners is a way to collect and verify the information and feedback from the people who are responsible for designing, implementing, and operating the control processes12. However, this way is not the best because it is subjective and qualitative, and may not provide reliable or comparable data on the efficiency of the control processes12.
Reviewing the risk register is a way to examine and update the documentation and status of the risks and the control processes that are associated with them12. However, this way is not the best because it is descriptive rather than analytical, and may not measure or evaluate the efficiency of the control processes12. References =
1: Risk IT Framework, ISACA, 2009
2: IT Risk Management Framework, University of Toronto, 2017
3: The Control Process | Principles of Management4
4: Control Management: What it is + Why It’s Essential | Adobe Workfront5
5: What is a Key Performance Indicator (KPI)? Guide & Examples - Qlik1
6: What is a Key Performance Indicator (KPI)? - KPI.org2
