You’re asked to create and maintain mitigation controls for a set of high-risk access combinations that business insists are required. Outline a pragmatic plan to design, test, and monitor those compensating controls to satisfy auditors while minimizing business disruption.

First I'd validate business justification and quantify the risk: map the high-risk combinations and record the number of users impacted. Then I’d design proportional compensating controls — for example, mandatory dual-approval, session recording via Firefighter, real-time activity alerts, and monthly reconciliation reports. I would pilot the controls with 10 business users for 30 days to capture false-positives and operational impact, aiming for >95% control coverage and remediation SLA of 72 hours. Technical tests and walkthrough evidence would be collected and stored in the control repository for auditors. After the pilot I’d phase rollout, provide training, and automate monitoring so exceptions generate tickets. Within three months of implementation I expect measurable risk reduction (e.g., 60% fewer open mitigation exceptions) while keeping business continuity intact.