Risk and control setup

Rate a business risk and assign the safeguard that addresses it.

Step by step

Choose the business unit Admin

Admin and Control Owner confirm the organization and operating unit that will carry the risk. The unit's active state and contact give the team an accountable context.
- Establish operating scope
- Updates Organizations, Business units
Rate the risk Control Owner

Control Owner states the problem, selects an owner and records likelihood, impact and the scale version used to make those values meaningful.
- Keep the rating and owner together
- Updates Risks, Business units, Team members
Prepare the safeguard Control Owner

The owner describes the control, gives it a code and effective date, and connects it to the risk.
- Connect the safeguard to the rated risk
- Updates Controls, Risks
Put the control in use Control Owner

The team checks that the owner can explain the safeguard and records it as Active when it is ready to be tested.
- Record the active safeguard and effective date
- Updates Controls
Carry it into assessment Compliance Lead

Compliance Lead includes the relevant control in the assessment's scoped work and gives Tester enough context to choose a sample.
- Give testing a defined control context
- Updates Assessments, Assessment tests, Controls

Start free, then use Proto to change fields, steps and approvals before your team goes live.