Risks and controls

A risk belongs to a business unit and has a named owner, likelihood, impact and scale version. The scale version matters because a score is hard to interpret without knowing which scale the organization used. A control has its own code, description, effective date, status and owner. Linking it to the risk makes the reason for the control explicit.

A facility access risk can have a control requiring periodic access review. The control owner maintains the wording and effective date; the assessment owner selects it for a period and tests it through the assessment record. Retired controls remain understandable in historical work, while new plans should select controls appropriate to the period.

• One accountable parent. Keep each activity linked to the relevant assessment, risk, control or finding so the next person can follow the same case.
• Named responsibility. Assign the record to the person who prepares the work and keep independent judgement with a separate reviewer where a decision is required.
• Visible outcome. Use the recorded state, result, date and evidence to explain what happened before moving the case forward.

Agree the likelihood and impact scales before entering scores. Decide who may change a risk owner and who maintains a control description or effective date. Review business-unit ownership when the organization structure changes. A control code should remain stable enough for earlier test results to be traced to the control tested at the time.

Rehearse an active control whose owner belongs to the correct organization. Then inspect an old test after changing the control’s current status. The earlier result should still be explainable from its parent assessment, control link and recorded evidence reference.

Take a facility access risk owned by a team member in the business unit under review. The control owner checks the control code, effective date and active status before the assessment owner selects it for testing. Once a test is recorded, its link to that control and its own evidence reference explain what was tested at the time. If the control is later retired, keep the earlier test and risk context available for review.

• My risks — Business-unit risks assigned to the current owner, with likelihood, impact and scale version.
• Tests needing results — Planned tests that need a result from the selected control.

Follow the related process and check the record definitions.