The best compensating control is performing a bank reconciliation. Duplicate payments are a financial processing error that results in overpayment or duplicate disbursement. ISACA materials explicitly cite duplicate payments as an example of information errors that create cost risk. A bank reconciliation is the best compensating detective control among the choices because it helps identify duplicate disbursements by comparing recorded payments with actual bank activity.

Option B is correct because reconciliation is the control most likely to detect that a payment was processed twice. Once identified, management can investigate and recover the erroneous payment.

Option A is not the best answer because hash totals are generally used to verify data integrity of fields, not to compensate for duplicate payment processing.

Option D is also not the best answer because control totals can help identify completeness or reasonableness during batch processing, but they are less directly effective at detecting duplicate disbursements already posted through an online payment process.

Option C is weak because manual receipting of payments does not directly address duplication of outbound payments.

Therefore, B is the best answer because bank reconciliation is the most effective compensating control among the options for detecting duplicate payment errors. The exact match to this exam-style question is based on standard CISA control reasoning, with ISACA support that duplicate payments are a recognized cost-risk example.

References (Official ISACA):

ISACA Journal, A Framework for Estimating ROI of Automated Internal Controls — cites duplicate payments and overpayments as examples of cost risk caused by information errors.

ISACA training and audit fundamentals resources — support the use of detective and compensating controls in audit practice.