Design

Design describes how a control or system is set up to achieve specific objectives.

For controls, design effectiveness is about whether the control, if operated as described, would reasonably reduce the targeted risk. For systems, design focuses on how architecture, processes, and responsibilities work together.

Audits typically evaluate both the design and the operating effectiveness of controls, meaning a control must be well-designed and executed consistently.