Tell me about a time when a key control exists only on paper and is not operating effectively. What did you do?

I first confirmed the facts and contained the immediate impact. Next, I reviewed the control evidence, sample test, exception log, and remediation plan and coordinated the action to confirm control objective, owner, evidence, frequency, reviewer, and exception handling. After verifying the result, I summarized the root cause, preventive control, owner, and follow-up plan so the issue would not recur.