Compensating controls that actually hold up in testing

When an exception is approved, the compensating control must be specific enough that a second person can re-perform it months later. “Manager will monitor” fails that test.

Stronger language names the reviewer, the frequency, the evidence artefact, and the threshold that triggers escalation. Example: “Procurement lead reviews weekly invoice listing for Vendor X; unmatched amounts above NT$50,000 escalate to the CFO within two business days; evidence stored in the shared exception folder.”

During our policy exception review engagements, weak compensating controls are the most common finding—not missing approvals. Approvals travel by email; the follow-through does not.

Ask owners to attach a sample of the evidence at approval time, not only at closure. Early samples show whether the control can even produce a trail.

If the control depends on a person who has left the company, reopen the exception. Personnel changes are a frequent quiet failure mode in Taiwan offices where one controller wears several hats.