An audit finds a control that is well designed and was not operating for four months. Why does that distinction matter and what causes it?

The distinction

Design effectiveness asks whether the control, if operated as intended, would address the risk. Operating effectiveness asks whether it actually operated, throughout the period, on every occurrence.

A control that is well designed and did not run provides no protection whatsoever. The design assessment is cheap and the operation assessment is what matters, which is the inverse of how most organisations allocate attention.

Why controls silently stop operating

• A dependency changed. The scanner's API moved, the credential expired, the integration broke — and the control failed open, reporting nothing rather than failing loudly.
• A bypass was added for an urgent deployment and never removed.
• The scope drifted. New services were created outside the pipeline the control lives in, so the control operates perfectly on a shrinking share of the estate.
• Nobody owns it. The person who built it left, and a control with no owner is not maintained.
• It was noisy and got muted, which is the most common end state for detective controls.

What prevents it

• Controls that fail closed. A gate that cannot evaluate should block, not pass. Failing open is how a control becomes decorative without anyone noticing.
• Monitoring the control itself — execution count, coverage percentage, failure rate — as a first-class signal. A control that stopped running produces silence, and silence looks like success.
• Coverage measured against the full estate, not against the systems the control knows about.
• A named owner with the control's health in their operational dashboard.
• Evidence generated continuously, so a gap is visible immediately rather than at the next audit.

The framing that changes behaviour

Treat controls as production systems. They need owners, monitoring, alerting, on-call and change control. Organisations that treat them as compliance artefacts get compliance artefacts, which stop working and nobody notices until the audit.