Design effectiveness asks whether a control should satisfy the requirement on paper. Operating effectiveness asks whether that control actually works in practice and produces evidence over time. In DORA contexts, both matter, because a documented control that cannot generate proof is still a compliance gap.
How design effectiveness and operating effectiveness differ in an audit
Design effectiveness is about intent: whether the control is written in a way that should meet the requirement if it is executed as described. Operating effectiveness is about execution: whether the control actually runs consistently, by the right people or systems, with enough evidence to prove it over the period under review.
The distinction matters because a control can look sound on paper but fail in practice if the workflow, ownership, timing, or evidence trail is weak. Auditors usually test design first, then test operation to see whether the control is more than a documented promise. In a compliance audit, both tests answer different questions and a pass on one does not imply a pass on the other.
For example, a policy may require access reviews every quarter. That policy may be well designed, but operating effectiveness depends on whether reviews happen on schedule, cover the full population, identify exceptions, and produce retained evidence that can be independently verified.
What auditors look for when testing each one
Design testing focuses on structure and logic. Auditors ask whether the control addresses the risk, whether responsibilities are assigned, whether the steps are complete, and whether the evidence the control is supposed to produce is actually defined. A control that lacks a clear owner, a trigger, or an evidentiary output is often weak even if the wording sounds strong.
Operating effectiveness testing focuses on observed behaviour over time. Auditors look for samples, timestamps, approvals, logs, reconciliations, exception handling, and consistency across the review period. The question is not whether the control exists in a policy library, but whether it performs reliably enough that an external reviewer would trust it.
That is why audit teams often separate test of design from test of operating effectiveness. A design finding usually means the control needs redesign or clarification. An operating finding usually means the control may be valid in theory, but execution, supervision, or evidence retention is failing.
Why the difference matters in compliance programmes
Compliance frameworks and regulators rarely care only that a control was documented. They care whether the organisation can demonstrate it worked in the assessed period. That is especially true in higher-assurance environments where evidence quality, traceability, and repeatability are part of the control objective. The SOC 2 Trust Services Criteria (AICPA) are a useful reference point because they tie control language to whether controls are suitably designed and implemented in practice.
This distinction is also why a documented control can still leave a compliance gap. If the control cannot generate credible evidence, the auditor may conclude that it is not operating effectively even when the process owner believes it is being followed. In practice, the evidence trail is part of the control, not a separate administrative afterthought. NHIMG’s Audit Evidence and Continuous Controls Monitoring Guide is useful here because it treats testability, evidence freshness, and control testing as operational requirements rather than audit extras.
For compliance teams, the real question is whether the control can survive scrutiny from a sample-based audit. A control that depends on informal habits, undocumented judgement, or manual recollection may appear effective until the first request for proof. By contrast, a control that is built to leave a reliable evidence trail is much easier to defend, verify, and repeat.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while SOC 2 (AICPA) and ISO/IEC 27001:2022 define the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| SOC 2 (AICPA) | CC5.1 — Control Activities | Design vs operating effectiveness turns on whether controls are suitably designed and function over time. |
| Recommendation — Document controls so they are testable and retain evidence of execution. | ||
| NIST SP 800-53 Rev 5 | CA-2 — Control Assessments | Audit testing distinguishes whether a control is designed well and actually works in operation. |
| Recommendation — Assess controls with evidence that distinguishes design from operating performance. | ||
| ISO/IEC 27001:2022 | A.5.35 — Independent review of information security | Independent review requires checking both control design and whether it operates as intended. |
| Recommendation — Review controls independently and verify that execution matches the documented design. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Operational control checks depend on repeatable execution and evidence, not just policy intent. |
| Recommendation — Validate that security processes run continuously and produce auditable evidence. | ||
Practitioner Guidance
What to verify: Check whether the control has an explicit owner, a defined cadence, a clear trigger, and a retained artefact that proves execution. If any of those are missing, the control may be well designed but difficult to defend as operating effectively.
Decision rule: If the control cannot produce objective evidence for the full review period, treat the issue as an operating effectiveness failure even if the policy wording is strong. If the process itself is incomplete or ambiguous, treat it as a design problem first.
What good looks like: A strong control has a clear written objective, is executed on schedule, leaves consistent evidence, and can be sampled without relying on tribal knowledge. In audit terms, the control is both explainable and provable.
Practitioner takeaway: Design effectiveness asks whether the control should work, but operating effectiveness is what auditors ultimately trust. If the evidence trail is weak, the control is weak for compliance purposes even when the policy language looks correct.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org