What must a control procedure do to be effective?

For a control procedure to be effective, it should serve its purpose of managing risks by either preventing potential problems from occurring or alerting individuals to the existence of potential issues that may arise. This dual functionality ensures comprehensive risk management.

When a control procedure is designed to prevent problems, it proactively stops issues before they arise, which is essential for maintaining organizational integrity and operational efficiency. On the other hand, alerting about potential problems is equally important because it provides timely information that allows for intervention and remediation before the issue escalates.

Thus, by encompassing both aspects, control procedures become a robust framework for risk management, ensuring that an organization can respond effectively to both preventable risks and emerging concerns. Therefore, the answer that states control procedures must either prevent or alert is appropriate, as it acknowledges the flexible nature of effective controls in different situational contexts.