Controls and risks

A risk names the workforce issue a business unit wants to manage. Its likelihood and impact are recorded with a scale version so two reviewers can understand the scoring basis. A Control Owner maintains a control code, description, effective date and status for the measure intended to address that risk. That link makes the control meaningful when a test later finds an exception.

Start with the business unit whose practices are under review. Record the risk in words that a tester and a legal reviewer can both recognize. If scoring changes, keep the scale version visible with the risk; a score without its scale can give a misleading impression when compared across assessment cycles. The control description should explain the practice being tested, rather than just repeat the risk title.

For example, a risk of incomplete time evidence at a business unit can be linked to a dated control describing how records are checked. During testing, the assessment test points to that control. If the test fails, the finding retains the control link, letting the owner decide whether the control itself needs work or the observed exception needs correction.

• Risk context. Identify the business unit, owner and scale version before comparing likelihood and impact.
• Control history. Keep the effective date and current status visible when the control is used in a test.
• Exception path. Follow a failed test through its linked control to the resulting finding.

Agree the scoring scale, who owns each risk, and what makes a control active or retired. Decide whether a new control code is needed when the underlying practice changes. Review a sample of controls with the people who will test them; a description that cannot guide a test should be revised before the assessment starts.

Choose a risk for one business unit and add its control. Ask the Assessment Owner to create a test linked to that control, then record both a passing and a failing result in the pilot. The Control Owner should be able to find the exception and see which control was tested. The Compliance Manager should be able to explain the risk and current control state from the records alone.

• Active controls — Current controls with their risk, effective date and owner.
• Open findings by severity — Findings tied to tested controls that still need a response.
• Assessments in progress — Assessments where those controls are being tested.

Follow the related process, review the data model and agree implementation steps with the team.