Controls are put in place to ensure adherence to policies and regulations. When are they also helpful?

• A. To set the correct levels of risk appetite
• B. To ensure audit engagements are tracked and on time
• C. For reducing or mitigating risk
• D. For reducing SLAs associated with vendor contracts

Answer: (C)

Controls are safeguards that enforce policies and regulatory requirements. Their main value is in reducing risk by preventing, detecting, or correcting policy breaches and compliance gaps. That’s why the best choice is that controls are helpful for reducing or mitigating risk—they directly lower the chance or impact of adverse events.

Setting risk appetite is about deciding how much risk the organization is willing to accept, not about implementing safeguards. Tracking audit engagements relates to governance and project management rather than the preventive/detective function of controls. Reducing SLAs in vendor contracts would typically increase risk or reduce service reliability, which is not the purpose of controls.