Which action best verifies that a control measure is effective?

• A. Track Relevant Metrics
• B. Conduct Audits
• C. Review Incident Data
• D. Adjust Controls as Needed

Answer: (A)

Ongoing measurement of how the control performs is what verifies its effectiveness. Tracking relevant metrics gives continuous, objective evidence about whether the control is achieving its intended outcome and staying reliable under real conditions. By collecting data like error rates, time to detect and respond, compliance levels, and incident frequencies, you can spot trends, catch deteriorations early, and decide if any improvements are needed.

Audits provide checks at a point in time, so they may confirm a control worked then but don’t prove it will keep working over time. Reviewing incident data shows what happened in the past, but it’s retrospective and can lag behind current performance. Adjusting controls as needed is an action taken after issues are found, not verification itself—it's the follow-up step guided by the verification results.