Control Activity

A control activity is a concrete action that helps ensure management’s risk mitigation directives are implemented.

Examples include approving new user access, reviewing exception reports, or verifying that backups completed successfully. These activities often show up in procedures, checklists, or workflows.

Control activities are the pieces auditors test directly when they evaluate whether a control is operating as intended.