Risks and Controls

Control Owner records each risk against a business unit, with a title, likelihood, impact, scale version and owner. A control links to that risk and carries a code, description, effective date, state and owner. This connection lets a tester explain why the control belongs in an assessment and who should answer questions about how it operates.

A risk is the reason for the control. The control is the object tested. Its owner supports test preparation, while the assessment owner decides the scope of the review.

• Ownership. The named person on a record is responsible for its next operational step.
• Working state. The recorded state tells colleagues whether preparation, review or follow-up is due.
• Evidence trail. Related records remain attached to the assessment or control that explains them.

Agree how likelihood and impact are scored and how the scale version changes. Keep control codes stable enough to follow through tests and findings. A description should state the actual practice being checked. Decide who moves a control from Draft to Active and how retired controls remain understandable in historical work.

In the pilot, choose a real operating period and a small set of named people. Check their membership and duties before entering historical material. Review who may see Internal evidence and who makes the independent decision. Agree how corrections are explained so the next reviewer can follow the record without relying on a private conversation.

A delivery unit identifies the risk that a departing consultant retains access. Control Owner records the scoring and creates a periodic access review control. Assessment Owner selects the active control for a quarterly assessment. Assessment Tester can then record a result against that precise control. If an exception appears, the finding links to the same control. Rehearse a retired control to keep historical tests readable without treating it as current coverage.

Have the receiving role open the record rather than relying on a summary sent outside the app. Check the selected organization, owner, dates and links to related work. If the case is returned, record a reason and leave the next action visible. This rehearsal should expose unclear authority before the team uses the same pattern across more engagements.

• Active Controls — Find current control codes, effective dates, risks and owners.
• Risk Register — Read each assigned risk with its business unit and scoring scale.

Follow the related process and use roles to check the handoff between people.