Risks and controls

A risk record carries a title, likelihood, impact and scale version. It belongs to a business unit and has a named owner. A control then describes what addresses that risk, the date it became effective and the person who owns it. The active status helps a tester select controls that are in force for the assessment period. The parallel scored-risk family uses its own team-member and counterparty references; a test must follow its control into the matching family.

• Source record. Start with the assessment, risk or finding that owns the work and follow its references before changing a status.
• Named responsibility. Use the linked owner or reviewer so the next action is accountable to a person in the organization.
• Recorded result. Retain the date, status, decision or evidence that explains why the work moved forward.

The Operations Overview helps the team see assessments, tests, decisions and failed operations in one context. Open the underlying record before acting, especially when two assessments have similar subjects. The record number, organization and period should identify the intended case. Decisions and retests should point back to the source they cover.

Agree the meaning of likelihood and impact, how a scale version changes and who can retire a control. Confirm whether a control effective date falls inside the assessment period. Give each control a useful code and description that a tester can recognize without guessing from the risk title. The team should rehearse these choices with a small, recognizable case before widening access. A named owner should check that a reviewer sees the right case and that a person outside the case cannot change it.

Take a risk involving privileged access in a business unit. The Control Owner records its likelihood and impact under the chosen scale version, then links an active control with an effective date. The Control Tester checks that the control was in force for the test date. A retired control remains part of earlier assessment history instead of being silently substituted. Walk the record from its first entry to the next person’s action. Check that dates, references and status tell the same story, and that evidence is available to the authorized reviewer. If the work is corrected, preserve the earlier result and the reason for the change. The team can then use the same handoff for a second case without relying on a side conversation.

• Controls in Force — Active controls with their risk and owner.
• Scored Risks by Unit — Risks grouped by business unit and recorded scale.
• Assessment Pipeline — Assessments that need a confirmed control scope.

Each view opens records with the fields needed for that decision. The person working the queue can compare the current status with the linked source, then open the record for its full history. A board or due-date list helps prioritize, while the recorded decision remains on the case.

Follow assessment preparation, testing and findings, independent review and verified closure. Start with the process that owns the record on this page, then inspect the next handoff before releasing work to another role.