Comprehensive and Detailed Step-by-Step Explanation:

Reference to IIA Standards:

Standard 2130 - Control: Internal auditors must assess both the adequacy of control design and the

effectiveness of control operation.

Reasoning:

Option B is correct because a poorly designed control, even if operating effectively, cannot achieve

its objective due to inherent flaws in its structure or implementation.

Option A incorrectly suggests that operational testing overrides design inadequacies. Evaluating

control design is essential before assessing operational effectiveness.

Option C is incorrect because reliance on secondary controls to mitigate risk does not compensate

for an inadequate primary control design.

Control Design Importance:

Adequate design ensures that controls are appropriately structured to address specific risks,

providing a strong foundation for effective operation.