Internal Controls

An Internal Control is an operational process, technical configuration, administrative policy, or physical measure deployed by an organization to enforce compliance and mitigate operational risks.

---

Control Dimensions

Every control registered in OrviQ captures:

• Business Reference: A permanent, human-facing identifier (e.g., CTL-2026-0012).
• Title & Description: Detailed operational explanation of the control activity.
• Control Owner: The designated individual or team accountable for execution and testing.
• Control Type: Preventive, Detective, or Corrective.
• Implementation Mechanism: Automated, Semi-Automated, or Manual.
• Operational Status: Active, Draft, Deprecated, or Inactive.

---

Two Stages of Control Evaluation

OrviQ evaluates controls across two independent, sequential dimensions:

1. Design Adequacy (CM-4)

Is the control designed well enough that, if operated as described, it would satisfy the mapped regulatory obligation?

• Adequate: The design comprehensively covers the obligation.
• Partially Adequate: The design covers key aspects but leaves minor gaps.
• Inadequate: The design fails to address critical aspects of the mandate.

2. Operating Effectiveness (Testing & Assurance)

Is the control actually functioning as intended over time?

• Effective: Verified through periodic testing, audit workpapers, or continuous assurance indicators.
• Partially Effective: Occasional lapses or test exceptions identified.
• Ineffective: Systematic failure or missing execution proof.
• Not Assessed: No formal operational testing has been completed.