These cookies are required for the website to function properly. They ensure security, enable basic features like page navigation, and store user session data. You cannot disable these cookies.
- Policy Management System
- Who it's for
- Operating unit assurance
Operating unit assurance
An operating unit can use the app to connect its risk register with recurring control tests. The risk record names the unit, owner, likelihood, impact and scale version. Each control names its owner, effective date and current status. An assessment then defines the period and planned tests for that unit, with individual results linked back to the controls.
How Policy Management System is set up for you
Defined scale
Use a named risk scale so reviewers can interpret likelihood and impact.
Testable controls
Select active controls whose effective dates fit the assessment period.
Visible exceptions
Keep failed tests and findings separate, with sample counts and evidence.
Assigned follow-up
Give corrective actions owners and due dates, then use independent retests to support closure.
An operating unit can use the app to connect its risk register with recurring control tests. The risk record names the unit, owner, likelihood, impact and scale version. Each control names its owner, effective date and current status. An assessment then defines the period and planned tests for that unit, with individual results linked back to the controls.
Pick one unit and one testing period. Record its main risks and the active controls chosen for review. The Assigned Tester enters a small set of results, including one failed case. The Control Owner opens a finding and assigns a corrective action. The Independent Assurance Reviewer retests the result and records evidence before the finding is closed.
Agree how the unit selects severity and how it handles inconclusive tests. Decide which evidence is shared with the reviewer and which remains internal. A pilot should let the team read the chain from risk through control, test, finding, action and retest without relying on a summary spreadsheet. The assessment's review decision can then refer to the same period and revision.
Features to start with
Roles on the team
- Control Owner
- Prepare assigned operational records and execute eligible reviewed actions.
- Independent Assurance Reviewer
- Review eligible revisions independently and reconcile operational evidence.
- Auditor
- Read authorized evidence and reports.
- Assigned Tester
- Records assigned control test results, sample details and evidence for assessment review.
Set up Policy Management System your way.
Start free, then use Proto to change fields, steps and approvals before your team goes live.