Compensating control
A measure that holds the line on a risk while a gap remains open (for example, human review of a model's outputs until a stale evaluation is re-run). A sound compensating control names three things: the exact boundary of the risk it covers, the trigger that forces human escalation, and who signs off and how often. Named in a flag so that a disclosed gap comes with an interim safeguard rather than an open exposure.
Defined in 3 GAGE programs, which carry 8 distinct definitions of it. The wording above is taught in Certified AI Governance Professional (CAIGP).
How each discipline defines it
The same term does different work depending on who is using it. These are the definitions as each program teaches them, unedited.
A measure that holds the line on a risk while a gap remains open (for example, human review of a model's outputs until a stale evaluation is re-run). A sound compensating control names three things: the exact boundary of the risk it covers, the trigger that forces human escalation, and who signs off and how often. Named in a flag so that a disclosed gap comes with an interim safeguard rather than an open exposure.
A structural or runtime control built at a boundary you do control specifically to offset residual risk from a safeguard you cannot verify or modify directly, such as a vendor agent's undisclosed internal safeguards (Section 3M). A compensating control does not require trusting the unverifiable part; it bounds the consequence if that part fails.
A control, or an engineered combination of preventive, detective and corrective mechanisms, that meets a baseline control's objective by a different design when the baseline control cannot be implemented as specified. Legitimate only when the objective it substitutes for is stated.
A mitigation applied at one component (for example, narrower tool permissions) to reduce the risk created by an unresolved gap at another component (for example, a protocol with no provenance check). Reduces exposure without claiming to fix the root cause.
A control an organization operates on its own side of a boundary with a third-party agent or system, added specifically to close a gap the third party's own controls do not cover, used when a vendor cannot or will not meet a required control depth directly.
Where it is taught
The exact lessons this term appears in. The first module of every program is free with a free account.
- The Parts That Make an Agent Act · The Agent, Deconstructed, Certified Agentic AI Governance Professional (CAAGP)
- The Control Typology · Technical Controls and Threat Modeling, Certified Agentic AI Governance Professional (CAAGP)
- Multi-Agent Controls · Multi-Agent Governance, Certified Agentic AI Governance Professional (CAAGP)
- Assembling the dossier: every artifact, every decision, one evidence file · The Capstone: The Board Audit and Viva, Certified AI Governance Professional (CAIGP)
- Control taxonomy and canonical catalogs · Internal Control Architecture and Control Engineering, Certified Enterprise Governance, Risk and Compliance Professional (CEGP)
- Key, compensating, common, and inherited controls · Internal Control Architecture and Control Engineering, Certified Enterprise Governance, Risk and Compliance Professional (CEGP)
- Exceptions, waivers, and risk acceptance · Policy, Standards, Procedures, and Exceptions, Certified Enterprise Governance, Risk and Compliance Professional (CEGP)
- Multi-domain due diligence · Third-Party, Supply-Chain, and Concentration Risk, Certified Enterprise Governance, Risk and Compliance Professional (CEGP)
Where it shows up at work
A definition is where Compensating control starts. The lessons above teach it inside the competencies below, which are what job descriptions ask for and what the GAGE credential records. Every link here is drawn from the same careers map that builds a role's readiness check.
Maps risks to preventive, detective and corrective controls, then tests design and operation with samples, evidence and defensible findings.
2 lessons on this page teach it as a primary outcome.
Designs multi step agent systems: orchestration graphs, tool contracts, memory, interruptibility, and the evaluation of agent behavior before it is allowed to act.
2 lessons on this page teach it as a primary outcome.
Tiers vendors by use and impact, requests evidence instead of promises, tests in the customer's context, and plans monitoring and exit.
One lesson on this page teach it as a primary outcome.
Roles that hire for it
Each role page shows the full competency set, what the seat decides, and a readiness check against your own evidence.
- Chief Audit Executive, AI audit editionneeds it at depth
- GRC Associate (AI)needs working knowledge
- AI Auditorneeds it at depth · 9 open postings this week
- AI Compliance Managerneeds it at depth · 2 open postings this week
- Security Compliance Managerneeds it at depth · 4 open postings this week
- AI Controls Analystneeds working knowledge
How job descriptions say it
Postings rarely use the textbook word. These are the phrases the careers map reads as asking for the competencies above.
Where the frameworks place it: COSO; ISO/IEC 42001 Annex A; Global Internal Audit Standards; IMDA Model AI Governance Framework for Agentic AI.
One interview question about it
Pick one AI control and tell me how you would test that it operated all year, not only that it was designed.
Asked of candidates for control design and operating-effectiveness testing. Answering it in your own words is exactly how a GAGE topic is passed, and the credential records the pass where an employer can check it.
If you come from another field
Some backgrounds already carry this competency, and the readiness check gives credit for it.
- Compliance and regulatory affairs carries it as work you can show: Control mapping and testing evidence exist in your files.
- Internal audit and IT audit carries it as work you can show: Tests of design and operating effectiveness are the core skill.
- Operations, claims, customer service and administration carries it as a claim to back up: Identifying process risks and quality checks is control thinking.
Terms it appears with
Not an alphabetical neighbourhood: these are the terms taught in the same lessons, ranked by how often they appear together.