Control design is the process of developing and implementing mechanisms to mitigate identified operational risks. Controls are classified into four distinct functional categories based on where they operate within the risk lifecycle:

[Risk Lifecycle Path]
   ├── 1. Directive Controls   ---> Establishes behavioral boundaries (Policies, SOPs)
   ├── 2. Preventative Controls ---> Hard blocks to stop failures (System Permissions)
   ├── 3. Detective Controls    ---> Flags failures after occurrence (Exception Alerts)
   └── 4. Corrective Controls   ---> Restores system equilibrium (Data Backups)

An effective control framework combines these functional types to provide defense-in-depth, ensuring that if a preventative control fails, a detective control identifies the issue, and a corrective control minimizes the impact. Control design must also balance risk mitigation with operational efficiency to ensure that controls do not introduce excessive process friction or cost more than the underlying asset exposure.