A practical guide to COSO Control Activities, its three principles, control design, technology controls, evidence, and GRC traceability.
Published: 8/24/2026Updated: 8/24/2026By growGRC Editorial Team
Executive Summary
Control Activities translate risk responses into actions through control design, technology controls, and policies and procedures.
Key Takeaways
✓Control Activities contain three COSO principles: selecting and developing control activities, general controls over technology, and deployment through policies and procedures.
✓Controls should be traceable to objectives and risks.
✓Technology controls support the reliability of automated and IT-dependent controls.
✓Policies do not by themselves demonstrate control operation; execution evidence is required.
✓Control effectiveness should consider both design and operating effectiveness.
COSO Control Activities
Control Activities are one of the five components of the COSO Internal Control — Integrated Framework. They are the actions established through policies and procedures that help ensure management directives for mitigating risks to the achievement of objectives are carried out.
Effective Control Activities are designed in response to identified risks and operate across organizational levels, processes, and technology environments.
Why Control Activities matter
Control Activities translate risk responses into concrete actions. They help prevent, detect, or correct events that could interfere with the achievement of objectives.
A mature Control Activities program helps an organization:
Design controls that address relevant risks.
Establish clear responsibilities and accountability.
Separate incompatible duties where appropriate.
Use technology controls appropriately.
Deploy controls through policies and procedures.
Maintain evidence that controls operated as intended.
Evaluate whether controls are designed and operating effectively.
Control Activities should not exist independently from objectives and risks. Their value comes from the relationship:
Objective → Risk → Control Activity → Evidence → Assessment
The three COSO Control Activities principles
The Control Activities component contains three principles.
Principle 10 — Selects and develops control activities
The organization selects and develops control activities that contribute to the mitigation of risks to the achievement of objectives to acceptable levels.
What are the three COSO Control Activities principles?
They address selecting and developing control activities, selecting and developing general controls over technology, and deploying control activities through policies and procedures.
What is the difference between a policy and a control?
A policy establishes expectations. A control is an action that helps mitigate a risk, and evidence demonstrates that the control operated.
What is control design effectiveness?
It asks whether the control, if performed as designed, is capable of addressing the relevant risk.
Why are technology controls important?
They support the reliable operation of systems and automated or IT-dependent controls.
From strategy to evidence
Set up your connected operating model. No sales delays or complex rollouts.
Control design should be based on the organization's risk assessment. The control should address a specific risk and have a clear purpose.
Examples include:
Approvals and authorizations.
Reconciliations.
Reviews and supervisory controls.
Physical safeguards.
Access restrictions.
Exception handling.
Validations and edit checks.
Segregation of duties.
Preventive and detective controls.
Control design should consider the nature of the risk, the control objective, the frequency of operation, the responsible role, the evidence produced, and the consequences of control failure.
Principle 11 — Selects and develops general controls over technology
The organization selects and develops general control activities over technology to support the achievement of objectives.
Technology is increasingly embedded in business processes. General technology controls can provide a foundation for the reliable operation of systems and automated controls.
Relevant areas may include:
User access management.
Privileged access.
Change management.
System development and implementation.
Backup and recovery.
Operations management.
Job scheduling.
Security configuration.
Logging and monitoring.
Interfaces and data transfers.
Technology controls should be connected to the risks and objectives they support rather than treated as an isolated IT checklist.
Principle 12 — Deploys through policies and procedures
The organization deploys control activities through policies that establish what is expected and procedures that put policies into action.
Policies and procedures should be documented, communicated, maintained, and available to the people responsible for performing controls.
Effective deployment should establish:
What must be done.
Who performs the activity.
When and how often it occurs.
What evidence must be retained.
What exceptions require escalation.
How control failures are handled.
How the activity is updated when conditions change.
A policy by itself does not demonstrate that a control operated. Evidence of execution is necessary to support operating effectiveness.
Types of Control Activities
Control Activities can be classified in several useful ways.
Preventive controls
Preventive controls are designed to reduce the likelihood that an unwanted event will occur.
Examples include approval requirements, access restrictions, segregation of duties, input validation, and configuration restrictions.
Detective controls
Detective controls identify events or conditions after they occur so that appropriate action can be taken.
Examples include reconciliations, exception reports, monitoring, periodic reviews, and audit logs.
Corrective controls
Corrective activities help address identified errors, incidents, or control failures.
Examples include remediation actions, recovery procedures, correction workflows, and root-cause actions.
Organizations may also classify controls as manual, automated, or IT-dependent manual controls.
Control design
A useful control specification should answer:
1. What risk does the control address?
2. What objective does the control support?
3. What action is performed?
4. Who performs it?
5. How frequently does it operate?
6. What evidence is produced?
7. What happens when an exception occurs?
8. What system or data does the control depend on?
9. How is the control monitored?
10. How is effectiveness assessed?
The answers create the basis for traceability and testing.
Segregation of duties
Segregation of duties reduces the risk that one individual can initiate, authorize, execute, and conceal an inappropriate transaction or activity.
A practical segregation-of-duties model can separate responsibilities for:
Requesting.
Approving.
Executing.
Recording.
Reconciling.
Reviewing.
The appropriate separation depends on the organization's size, structure, risk profile, and operating model. Where full separation is not practical, compensating controls may be necessary.
Technology and automated controls
Technology can make Control Activities more consistent and scalable, but automated controls depend on reliable systems and supporting technology controls.
For example, an automated approval workflow may depend on:
Correct configuration.
Reliable identity and access management.
Change controls.
Complete and accurate data.
System availability.
Logging.
Monitoring.
A GRC program should therefore preserve relationships between business controls, automated controls, and general technology controls.
Policies, procedures, and evidence
A policy describes expectations. A procedure describes how the expectation is performed. Evidence demonstrates that the control actually operated.
These should not be treated as interchangeable.
For example:
Policy → Procedure → Control Execution → Evidence → Assessment
Evidence may include approvals, system logs, reconciliation records, review sign-offs, tickets, reports, screenshots, or other records appropriate to the control.
Evidence should be sufficient to support the conclusion about operating effectiveness.
Control Activities in a GRC operating model
A GRC platform should maintain traceability among:
Objective → Risk → Control → Control Owner → Procedure → Evidence → Test → Result → Deficiency → Remediation
This allows organizations to identify which controls address critical risks, which controls are overdue for testing, where deficiencies exist, and what remediation actions are required.
Useful control metadata can include:
Control ID.
Control objective.
Risk ID.
Control description.
Control type.
Frequency.
Control owner.
Performer.
Reviewer.
Technology dependency.
Evidence requirement.
Testing method.
Last test date.
Next test date.
Effectiveness result.
Control effectiveness
Control effectiveness should consider both design and operation.
Design effectiveness
Design effectiveness asks whether the control, if performed as designed, is capable of addressing the relevant risk.
Operating effectiveness
Operating effectiveness asks whether the control actually operated as designed during the relevant period.
A control can be well designed but fail to operate consistently. Conversely, a consistently performed activity may not adequately address the underlying risk.
Common implementation mistakes
Creating controls without linking them to risks
A control should have a clear reason for existing and should address a relevant risk or objective.
Treating policies as controls
A policy establishes expectations, but it does not by itself demonstrate control execution.
Ignoring technology dependencies
Automated and IT-dependent controls may fail when underlying access, change, configuration, or data controls are weak.
Overly broad control descriptions
A vague control is difficult to execute consistently and difficult to test.
Missing evidence requirements
If evidence is not defined, the organization may struggle to demonstrate that the control operated.
Excessive manual controls
Manual activities can be appropriate, but unnecessary manual controls may increase operational burden and error risk when automation is practical.
Approved policies, procedures, communications, training records, control execution evidence
Evidence should demonstrate both the existence of the control and its operation where operating effectiveness is being assessed.
Conclusion
COSO Control Activities convert risk responses into actions that help organizations achieve their objectives. The three principles address selecting and developing control activities, establishing general controls over technology, and deploying controls through policies and procedures.
In a GRC environment, Control Activities are most valuable when they are traceable from objectives and risks through control ownership, procedures, evidence, testing, deficiencies, and remediation.
SUPPORTS
COSO Control Testing: A Practical Guide
A practical guide to COSO control testing, covering design effectiveness, operating effectiveness, evidence, sampling, exceptions, deficiencies, remediation, retesting, and assurance coordination.
