Risk and control register

A risk belongs to a business unit and a named owner. Its likelihood, impact and scale version preserve the basis for comparison. A control then points to that risk, describes the activity that mitigates it, records an effective date and names its own owner. This chain helps the Assessment Owner choose relevant controls instead of assembling a test plan from labels alone.

For a payments unit, the Risk Manager may record an operational risk and its scoring basis. The Control Owner records a control with a code, a description and the date it took effect. When an assessment tests that control, the test and any resulting finding retain a direct link back to it. A later change to a risk score does not turn an old test into proof of the new score.

• Business context. Risks attach to the operating unit where they matter.
• Control ownership. Each control has a named owner, effective date and status.
• Test lineage. A test references the control it actually examines.

Agree a versioned likelihood and impact scale before importing scores. Teams should know whether a larger number means a greater risk and which scale version was used. Set a convention for control codes so the same code is not casually reused for unrelated activities. Agree what the effective date means when a control changes and when a retired control stops entering new assessment plans.

The Risk Manager and Control Owner should review each link together. A control assigned to the wrong risk creates misleading evidence even when the test itself is accurate. The business unit must be active and connected to the organization used for the assessment. The owner mapping should identify a real team member, not a free-text name that changes between cycles.

Start with a payments risk, an active control and an assessment of the same unit. Confirm the test references that control and that the control references the intended risk. Then retire the control and prepare a later assessment. The team should decide how to preserve the earlier test while selecting an appropriate control for the new period.

Ask the Control Owner to explain the description and effective date to the reviewer. Ask the Risk Manager to explain the score scale without changing old evidence. If a control has no relevant assessment test, it should be visible as a planning question, not silently treated as tested. A control test marked Pass still needs its recorded evidence reference before the result can be relied on.

• Active controls — Review current controls with their risk, owner and effective date.
• Control test exceptions — Find failed and inconclusive results attached to tested controls.

Review how controls enter an assessment and check the data model.