An internal auditor is explaining, under the 2024 Global Internal Audit Standards, the difference between a control's design effectiveness and its operating effectiveness. Which statement correctly describes design effectiveness?
- ADesign effectiveness means the control has been shown to work consistently throughout the whole period under review.
- BDesign effectiveness means the cost of running the control is proportionate to the exposure that it mitigates.
- CDesign effectiveness means the control is documented within a recognised framework such as COSO.
- DDesign effectiveness means the control, if it operates as intended, is capable of preventing or detecting the risk it addresses. Correct
Why A is wrong: This is tempting because a well-designed control is expected to work, but describing consistent operation across the period defines operating effectiveness, not design effectiveness.
Why B is wrong: This is tempting because proportionate cost is a valid concern, but it describes the efficiency of a control rather than whether its design is capable of addressing the risk.
Why C is wrong: This is tempting because anchoring to a framework is good practice, but merely documenting a control in COSO does not establish that the control's design is capable of addressing the risk.
Why D is correct: Correct: design effectiveness is a capability judgement, asking whether the control would address the risk assuming it operated as intended, before any test of actual operation.