Plain definition
A compensating control is a different action that reduces a risk when the preferred control cannot be used or is not feasible. It is not simply any extra review. It should address the same risk with enough frequency, independence, evidence, and authority to make the residual risk acceptable for the circumstances.
Compensating controls are common in small teams, during system outages, or while a new workflow is being implemented. They may be less efficient or less timely than the original control, so management should understand the limitation and decide whether the arrangement is temporary or sustainable.
Illustrative example
Suppose a small subsidiary has one accounts-payable employee who can create supplier records, enter invoices, and prepare the weekly payment file. The subsidiary cannot immediately split the job. As a compensating control, a controller at the parent company receives the payment file, invoices, purchase evidence, and a bank-change report before release; the controller independently checks unusual suppliers and authorises the bank approver to release the file.
This review does not create perfect separation inside the subsidiary, but it adds an independent challenge at the point cash leaves. If the controller only signs a total without access to the documents, the additional step would not compensate for the incompatible duties.
A compensating control should be documented with its limitation and reviewed when the original control becomes feasible.
Why it matters
It enables a business to manage a real risk during practical constraints without pretending that the preferred control exists.
It helps leaders judge whether a workaround genuinely reduces risk or merely adds an unexamined signature.
Practical consequence
Define the unavailable control, the precise risk it addresses, and the evidence an independent reviewer needs to inspect.
Set a review date and owner for restoring the preferred design, and test samples of the workaround for the quality and timeliness of the review.