Glossary · Testing and assessment
A control is a habit an auditor can test.
A measure that changes or keeps a risk in check, such as a policy, a procedure, a technical setting or a review, run consistently and owned by someone.
Back to the glossary01 · In plain words
In plain words
A measure that changes or keeps a risk in check, such as a policy, a procedure, a technical setting or a review, run consistently and owned by someone.
A control is something you do, or a setting you keep, so that a risk is less likely or less harmful. A second engineer approving code before it ships is a control. So is disk encryption, a quarterly access review, or a rule that new hires sign a confidentiality agreement. What turns a good intention into a control is that it runs every time and leaves a trace.
02 · Why it matters
Why it matters
Who cares about this, and what depends on it.
Audits are built from controls. An ISO/IEC 27001 auditor checks that the controls you chose answer your risks and that they operate. A SOC 2 auditor tests the controls you describe against the Trust Services Criteria, and a Type 2 report shows whether they worked across a period. Neither framework hands you a finished list. You design controls that fit your system, then prove them. A control worded more grandly than the team practises it is one of the most common sources of exceptions.
03 · Where you meet it
Where you will meet it
The documents, meetings and reports where it appears.
- ISO/IEC 27001 Annex A
- A reference set of 93 controls in four themes, compared with your risks in the Statement of Applicability.
- The tests section of a SOC 2 report
- Each control, the auditor's test of it and the result, including any exceptions.
- The risk register
- Each risk points to the controls that treat it.
- The control matrix
- The working sheet with every control, its owner, its frequency and the evidence it leaves.
04 · An example
A worked example
An illustration, not a real client.
Illustrative: a code-review control that overpromised
A Gurugram fintech words its change control as 'all production changes are peer reviewed before release'. During the SOC 2 period, engineers sometimes merge urgent fixes at night and get approval the next morning. The auditor samples 40 changes and finds 3 approved after deployment. Each is a deviation from the control as written. The company rewrites the control to match how it really works: normal changes are approved before merge, and emergency changes are reviewed within one business day through a ticket linked to the incident. The next period, the control is narrower, honest and testable.
05 · Easy to mix up
Easy to mix up with
Neighbouring terms that mean something different.
- Control objective
- The goal a group of controls should reach, such as only authorised changes reaching production. The control is the specific measure that gets you there.
- Policy
- A policy states intent and rules. It becomes a control only when someone runs, checks or enforces it, and that leaves evidence.
06 · What to do
What to do with it
Practical steps, and the guides that go deeper.
- Write each control as who does what, how often, and what record it leaves.
- Give every control a named owner.
- Map controls to the risks or criteria they answer, so gaps and duplicates show.
- Test a few yourself before an auditor does.
- GuideThe SOC 2 controls listNo official list. Example controls grouped by the team that owns them.
- GuideISO 27001 Annex A controlsAll 93 controls in four themes, with what each one asks.
- GuideWho owns each SOC 2 controlA role map from engineering to HR to leadership.
Sources: ISO/IEC 27000 (vocabulary) and ISO/IEC 27001:2022 Annex A control titles; AICPA 2017 Trust Services Criteria with revised points of focus (2022); COSO Internal Control, Integrated Framework (2013).
Questions about Control
What is the difference between a preventive and a detective control?
Before the problem, or after it.
A preventive control stops a problem, such as blocking sign-in without multi-factor authentication. A detective control finds one after the fact, such as an alert on unusual logins or a monthly access review. Good programmes use both, because no preventive control is perfect.
Is an automated control better than a manual one?
More consistent, not automatically better.
Automated controls run the same way every time, which helps across a Type 2 period. They still need a check that the configuration has not drifted. Manual controls suit judgement calls but depend on people remembering, so the record behind them matters more.
Want this applied to your own systems?
Our team can walk through where this term touches your scope, your contracts and your evidence.