Risk and control setup

Identify a unit risk, give its control an owner and prepare it for testing.

Step by step

Identify the unit Compliance Lead

Compliance Lead selects the organization and business unit where the risk applies. Confirm the unit code and contact before work begins.
- Establishes the operating boundary
- Updates Organizations, Business units
Score the risk Control Owner

Control Owner records a clear title, likelihood, impact and scale version. A reviewer of a later period should be able to interpret the same numbers.
- Captures likelihood, impact and scale version
- Updates Risks
Assign a control Control Owner

Control Owner describes the mitigation, assigns its owner and enters an effective date. Keep its code stable for later test records.
- Links mitigation to the scored risk
- Updates Controls, Risks
Activate the control Compliance Lead

Compliance Lead checks the owner and description before the control moves from draft to active. Retired controls remain identifiable on historical findings.
- Changes Status from Draft to Active
- Updates Controls
Select for testing Assessment Owner

Assessment Owner includes the active control in the assessment's planned tests and asks for evidence from its owner.
- Connects the test to the control
- Updates Assessments, Assessment tests, Controls

Start free, then use Proto to change fields, steps and approvals before your team goes live.