Risk and Controls

Risk records give a business unit a named exposure, an owner and a likelihood and impact on a stated scale. A control then links to that risk, names its owner and records when it became effective. This chain helps the team select controls for an assessment without relying on a private spreadsheet of assumptions. It also lets a reviewer ask whether a tested control was active for the period being assessed.

Consider a branch whose reconciliation risk has a high impact. The Control Owner records the risk with the scale version used to score it, then identifies the control that mitigates it. The control description says what the control does. Its owner is the person who can explain and supply evidence. A control marked retired should not quietly be presented as the current safeguard for new testing.

• Business-unit risk. Each risk has a title, owner, likelihood, impact and scale version tied to one business unit.
• Owned control. Each control links to a risk and names the staff member responsible for its operation.
• Effective state. Effective date and status help the tester interpret the control in the reporting period.

Agree on a scoring scale and write its version consistently. The numeric likelihood and impact are meaningful only when the team understands that scale. Set a rule for when a control becomes active and who may retire it. Before a new assessment starts, check that business-unit ownership and control ownership still match how work is done.

An organization can contain multiple business units. Establish stable names and codes so a branch is not entered twice under slightly different labels. Team member records also carry organization and user identity; map them before using ownership as a work queue. The administrator can review inactive people and units so current work goes to the right place.

Choose one business unit and create a risk with a named owner and scale version. Link an active control, add its description and effective date, then hand it to a Control Tester for a sample assessment. Ask the tester to identify the risk and owner from the control record alone. Ask the reviewer to compare the effective date with the assessment period. That exercise shows whether the chain can support an assurance decision.

When a control changes, keep the distinction between its design and a test result. A passing test records evidence of one execution; it does not automatically change the risk score or make a retired control active. Review those decisions separately with the responsible owner.

• Assessments in review — Open the assessment where the linked control evidence will be judged.
• Failed control tests — Find tests that need a closer look at the underlying control.

Use scope and testing to take a control into an assessment. Review findings and retests when testing reveals a gap.