Risks and Controls

A risk belongs to a business unit and has an owner, likelihood, impact and scale version. A control links to a risk, has its own owner and records when it becomes effective. These relationships help a reviewer follow a change from the business unit affected by a rule to the control the team expects to operate. They also give test owners a stable control code to cite when recording a result.

The control status tells the team whether it is being drafted, is active or has been retired. A retired control can remain part of the historical record of an assessment, but current test planning should consider its status and effective date. The Control Owner and Independent Assurance Reviewer can inspect active controls before deciding what evidence to request.

• Business unit risk. Describe the risk and record likelihood, impact, scale version and owner.
• Control ownership. Give each control a code, description, owner and effective date.
• Test linkage. Link assessment test lines and findings back to the control being examined.

Agree on the likelihood and impact scale before using its numbers to compare risks. Record the scale version so a reviewer can understand why two ratings differ over time. Decide who maintains control descriptions and when a change to a control calls for a fresh test. The effective date should represent when that control is expected to operate, rather than when somebody first entered it.

Consider a business unit affected by a rule with an upcoming effective date. Its risk owner updates the risk context, while the control owner reviews the relevant control description and status. The assessment owner then selects the controls to test. The record links make that sequence inspectable without pretending that an impact count is the same as evidence of a working control.

Open an active business unit, a risk owned by a named team member and an active control linked to that risk. Ask the test owner to identify the control code in an assessment test line and explain the evidence reference. If a finding was raised, check that it points to the same control and assessment. Then ask the reviewer whether the effective date and control description match the rule change being assessed.

A good handoff lets the reviewer move from the business unit to risk, control, test and finding without guessing which similarly named record applies. Review the owner on each record as well. When responsibility changes, the next team member should see the record’s current state and the evidence already collected.

• Active Controls — Review current controls with their risk, owner and effective date.
• Active Business Units — Confirm the organization and contact for the unit in scope.

See assessment planning and control testing.