Risks and controls

A risk belongs to a business unit and has a title, likelihood, impact and scale version. Those values give the team a recorded basis for discussing priority. A control references the risk, names an owner, describes the mitigating activity and states when it became effective. The status distinguishes a draft from an active or retired control. This connection helps the assessment owner plan tests against the controls in use for the unit.

A control’s owner is the person who can explain the activity and respond when a test fails. The tester records each individual result against both an assessment and a control, with a control code and evidence reference. When a failed or inconclusive test becomes a finding, that finding also points to the control and assessment. The chain stays readable from risk to control to test to corrective action.

• Risk scoring. Record the scale version with likelihood and impact so scores from different periods can be interpreted.
• Control register. Give every control a code, owner, effective date and current status.
• Test context. Link each test to the actual control and assessment rather than describing it only in notes.

Choose one scoring scale for the pilot and explain what likelihood and impact mean to the operating team. Decide who may change a control description and how the team treats a retired control in an ongoing assessment. Agree whether a control effective date precedes the assessment period being tested. Keep the code stable enough for people to locate the same control in a later review.

The Compliance Lead should agree how the control owner and independent reviewer communicate after a failed test. The owner supplies operational explanation and corrective work; the reviewer makes their own retest record. The separation is especially useful when a control looks effective on paper but the evidence from the operating unit tells a different story.

Consider a business unit with a risk of an untreated discharge. The control owner records the mitigation step, its effective date and the person accountable for it. The assessment owner plans a test for the period. The tester samples the supporting record, enters the sample size, exception count and result, and points to the evidence reference. A failed result leads to a finding linked to the same control.

The control owner can now see exactly which test raised the concern. The compliance lead can compare the control’s status with the test date before asking for remediation. After corrective work, a separate reviewer records the retest outcome against the finding. A passing result is meaningful because the risk, control and original failure remain connected.

• Active controls — Work from the controls currently in use and their named owners.
• My controls — Show each control owner the items assigned to them.
• Control test exceptions — Review failed and inconclusive evidence by linked control.

See risk and control setup before assessment testing.