Risks and controls

A risk belongs to a business unit and has an owner. Its likelihood, impact and scale version make the rating explainable when the team revisits it later. A control links to that risk, identifies its owner and states when it takes effect. This connection gives a tester a reason to check the safeguard and gives the Control Owner a clear place to respond to a failure.

Consider a business unit whose evidence review often runs late. The Control Owner records the risk and rating used by the organization, then describes the safeguard expected to reduce it. The control code identifies the safeguard across testing and findings. A changed rating should not make the earlier assessment impossible to explain; the scale version supplies the context for comparison.

• Risk record. The Control Owner records the affected business unit, likelihood, impact and rating scale.
• Control record. The owner connects a described safeguard to that risk and gives it an effective date and status.
• Test context. The Tester uses the active control and its code when documenting the sample and result.

Define the rating scale and when its version changes. Decide who owns a risk when a business unit has several teams, and how a control owner receives exceptions from an assessment. Agree what Active means operationally: the control should have a description, effective date and person responsible before the team relies on it in testing.

The link between risk and control should survive handoffs. If an owner leaves, update the owner reference while retaining the business unit and safeguard description. If a safeguard is retired, the team should be able to distinguish earlier tests of that control from current work. Plan the first pilot around risks that already have a responsible business unit and a known owner.

Start with one rated risk for a business unit. Ask the Control Owner to explain why its likelihood and impact were selected and which scale version applies. Open the connected control, inspect its description and effective date, and confirm the owner knows what evidence a tester will request. Then have the Tester record a sample against that control during the assessment period.

If the test finds an exception, the finding points back to the control and assessment. The Control Owner can see precisely which safeguard failed. A corrective action then has a different owner and due date, so the risk owner does not have to infer progress from a general assessment status. Revisit the risk after the finding is closed and decide whether the rating needs a fresh review.

• Active controls — Safeguards currently in use, with their risk, owner and effective date.
• Failed tests — Test outcomes that need attention from the control owner.

See risk and control setup and testing and remediation.