Which scenario best illustrates a compensating control?

• A. Removing a control due to cost concerns
• B. Implementing a different procedure to achieve similar risk reduction when the primary control cannot be implemented
• C. Increasing the number of users with access
• D. Deferring risk assessment

Answer: (B)