Comprehensive and Detailed 250-300 Words Explanation From Exact Extract from Chief Information Security Officer (CCISO) Documents:
According to the EC-Council CCISO Body of Knowledge, an auditor's primary concern when assessing internal control objectives is whether controls ensure compliance, operate with effectiveness, and do so with efficiency. These three principles form the foundation of internal control evaluation across governance, risk, and audit disciplines.
Compliance ensures that controls meet regulatory, legal, contractual, and policy requirements. Auditors evaluate whether controls align with applicable standards such as ISO, NIST, or regulatory mandates.
Effectiveness measures whether controls actually achieve their intended purpose-reducing risk, preventing misuse, or detecting issues. Efficiency assesses whether controls achieve results without unnecessary cost, complexity, or operational burden.
The CCISO framework emphasizes that auditors do not design controls; they evaluate whether controls are appropriately designed and functioning as intended. While confidentiality, integrity, and availability are core security objectives, they are outcomes of effective controls-not audit objectives themselves. Cost and communication are considerations but not primary internal control objectives.
Therefore, compliance, effectiveness, and efficiency represent the auditor's core evaluation criteria and are the correct answer.