Risks and controls

A risk belongs to a business unit and has a title, likelihood, impact and scale version. Its owner is a named team member. A control records the mitigation description, effective date, status and a separate owner. That connection matters when an assessment selects controls: the tester needs to know which risk the test addresses and which control was effective in the assessment period.

For a site excavation review, the team may record a risk against the operating unit and identify a control to test. The control owner can explain the practice and provide context, while the Assessment Owner decides which control tests belong in scope. Retiring a control should leave its earlier assessment tests understandable; it should not change what was tested at the time.

• Scale. Agree how likelihood and impact are scored and keep the scale version with the risk.
• Effective date. Decide when a control starts applying so tests are linked to the right control period.
• Ownership. Name who maintains the risk and who maintains the control when those responsibilities differ.

The Control Owner and Compliance Manager should rehearse how this work is assigned and reviewed. Agree which organization and business unit own the first case, who may update it, and where its supporting evidence lives. Set a clear handoff when the person preparing the record is different from the person checking its outcome. Use the same rule for routine work and exceptions so an urgent item does not lose its owner or history.

For the pilot, choose one business-unit risk and document the likelihood and impact scale used to score it. Link a named control owner and effective date to the mitigation. The Assessment Owner should confirm those details before putting the control into a test plan.

Create a business unit risk with its scale version and owner. Add an active control, an effective date and its owner. Scope an assessment using that control, then inspect the linked test line. The control code and risk relationship should let a reviewer trace the result to the intended mitigation. After recording a finding, confirm that it still points to the control that was tested, even if the control’s current status later changes.

Open Current controls to confirm the effective date, owner and linked risk before planning a test. Compare the control code on the planned test with the control being reviewed. If the control is retired later, keep the earlier result linked to the control tested at that time.

• Current controls — Active controls with owner, risk and effective date.
• Tests requiring evidence — Pending or inconclusive results awaiting a clear test record.

See the related process for the stage-by-stage handoff. Use the data model to inspect the record relationships and implementation to plan the first rehearsal.