COSO Principle 10: The entity selects and develops control activities that contribute to the mitigation of risks to the achievement of objectives to acceptable levels
Control activities help ensure that risk responses that address and mitigate risks are carried out
Management considers how the environment, complexity, nature, and scope of its operations, as well as the specific characteristics of its organization, affect the selection and development of control activities
Management determines which relevant business processes require control activities
Control activities include a range and variety of controls and may include a balance of approaches to mitigate risks, considering both manual and automated controls, and preventive and detective controls
Management considers control activities at various levels in the entity
Management segregates incompatible duties, and where such segregation is not practical, management selects and develops alternative control activities.