What should auditors evaluate when assessing the effectiveness of controls?

When assessing the effectiveness of controls, auditors should evaluate both the design and operating effectiveness of those controls. This means looking at whether the controls are appropriately designed to mitigate the identified risks and whether they are functioning as intended.

The design effectiveness involves evaluating whether the controls are adequate and suitable for managing the specific risks they are meant to address. On the other hand, operating effectiveness focuses on how well the controls are actually implemented and whether they are being adhered to consistently over time. An effective control system requires both aspects to ensure that risks are appropriately managed.

The other options, while potentially relevant, do not capture the totality of what needs to be assessed. The cost of implementing controls and cost-related benefits may be important considerations for a business, but they do not directly assess the effectiveness of the controls themselves. Similarly, the duration for which the controls have been in place may provide a context for their review, but it does not inherently indicate their effectiveness. Thus, evaluating both the design and operating effectiveness is crucial to understanding the overall performance of control measures in an organization.