FFIEC IT Examination Handbook IS-II.C.3: II.C.3 Control Types (Information Security)

Management mitigates risk with preventive, detective and corrective controls of administrative, technical and physical nature arranged in layers at different points of the business process and the IT system, so that one control compensates for the weakness or failure of another, with compensating controls such as log review where a weakness such as inadequate segregation of duties cannot be removed.