DEFINITION
Control Override
A control override is the deliberate bypass of a configured system control so a transaction can proceed — a matching tolerance overridden, a blocked vendor released, an approval step skipped. The control operated as designed and was set aside.
Overrides are legitimate in exceptional circumstances, which is why they exist. The risk indicator is not the individual override but its concentration.
Where overrides cluster among a small number of users, entities, or periods, the control has effectively become optional. Analytics therefore report override rates and concentration alongside individual instances.