Risk and control register

A university risk register is useful when a named person can explain the risk and point to the control intended to address it. The Risk and control register ties each risk to a business unit and an owner. It records likelihood, impact and the scale version used to judge them. A control carries its own owner, description, effective date and status. That connection lets an assessment team select a control for testing without losing the business context behind it.

Begin with a risk the institution can describe plainly. For example, a campus unit may depend on a review of access to sensitive records. Record the accountable unit and owner, then describe the control the owner performs. The control code helps the testing team recognize the same control across assessment periods. The effective date helps distinguish the current version from an older practice.

• Unit responsibility. The business unit places the risk in an operating part of the organization and names a contact.
• Risk judgement. Likelihood and impact use an agreed scale version, so owners can explain what a score meant at the time.
• Control responsibility. A separate control owner maintains the description, effective date and active or retired state.

Agree which organizations and business units own the first review cycle. Confirm that each team member belongs to the right organization and that the unit code is stable enough to use in review conversations. Set the likelihood and impact scale before comparing risks. Ask control owners to use descriptions that name the actual check, who performs it and the evidence they can produce.

A control marked active is a candidate for assessment planning. Retired controls remain useful as historical context, but a new test plan should identify the control in force for its assessment period. Decide how owners will record a replacement control before old work is retired.

Take one unit risk through to a named control. Have the risk owner explain its likelihood and impact using the recorded scale version. Have the control owner confirm the code, description and effective date. Then ask the Assessment Owner to identify the control for the next assessment. If the owner cannot locate the right record or the description does not explain the check, resolve that before planning tests.

• Active Controls — Current controls with their codes, owners, related risks and effective dates.
• Assessment Status Board — The assessments in which control work is being planned or reviewed.

Use assessment planning to select controls, then follow testing and findings when evidence arrives.