If key control activities have not been implemented or are not achieving their prescribed purpose, then an unsatisfactory rating for this control component normally would be warranted. Stated differently, there must be reasonable assurance that key control activities are operating as intended, based on their control objectives. If the risk mitigation strategy of management is absent or not adequately reflected in control activities, then this condition alone would call for an unsatisfactory rating.