A Compensating Control is an alternative safeguard used when the preferred control cannot be implemented fully or immediately. For example, enhanced monitoring and a daily transaction review may temporarily reduce risk when a legacy application cannot enforce a separation-of-duties rule.
A compensating control should address the same risk objective, have an owner and expiry date, produce evidence and be reviewed for effectiveness. It is not a permanent waiver.