What does 'control efficacy' mean in a TPRM program?

• A. The cost of implementing controls.
• B. How effective implemented controls are at reducing risk.
• C. Whether controls exist on paper.
• D. How many controls are in place.

Answer: (B)

Control efficacy means how well the controls that are actually in place reduce risk in practice. It focuses on operating effectiveness and the real impact on risk exposure, not just whether a control exists or how much it costs or how many controls are implemented. In a TPRM program you determine efficacy by testing how well the controls perform, monitoring for failures, and looking at the residual risk after controls are applied. A control might be documented or expensive, or there might be many controls, but if it isn’t properly configured, implemented, or maintained, its ability to lower risk is limited. For example, encryption or access controls only reduce risk effectively if keys are rotated, access is truly restricted, and procedures are followed.