"Surely it is the effectiveness of a control that is more important than the design - if it controls the risk, and the cost/benefit of the control is acceptable, then it works, irrespective of any inefficiencies of design.
As for the "well designed"…"