What is a true statement regarding compensating controls?

Compensating controls play an essential role in the internal control framework, particularly when key controls are either not effective or not feasible to implement. These compensating controls are designed to offset or mitigate risk by providing alternative measures that achieve similar objectives as the primary controls. When key controls fail or cannot be executed effectively due to various constraints (such as cost, complexity, or operational limitations), compensating controls ensure that an organization's risk profile is managed appropriately.

For example, if an organization cannot implement a strong segregation of duties within its financial processes, it might employ compensating controls such as increased monitoring or oversight, periodic audits, or additional approvals to ensure that the same level of risk management is achieved. In this way, compensating controls serve to reinforce the overall control environment and help safeguard the organization against potential losses or compliance issues.

The other statements do not accurately describe the nature and function of compensating controls. They are not deemed unnecessary in the presence of effective key controls, are not limited to large organizations, and are ideally proactive rather than solely reactive to potential losses.