Risk and controls

A risk identifies the affected business unit, owner, likelihood, impact and scale version. A control records its code, description, effective date, status and owner. Linking the control to the risk gives testers the context behind a test and lets reviewers trace a failure to the business area that carries it.

Control owners should agree the scale used for likelihood and impact before entering comparative scores. Retired controls remain useful to explain earlier assessments, while active controls are the candidates for current test planning. A risk score by itself is a prioritization input; the human reviewer still examines test results and the scope of the export review.

• Score the risk. Keep likelihood, impact and scale version with the affected business unit.
• Name the control. Link its code and description to the risk and assign an owner.
• Check applicability. Compare effective date and status with the assessment period before testing.

Agree the scoring scale before Control Owners enter likelihood and impact. Name who maintains each risk and control, and decide when a control becomes active or retired. Make the effective date part of test planning so a current control is not assumed to have applied in an earlier period. Keep the business unit link clear when the same organization has several operating groups.

Choose a risk for one business unit and record its owner, likelihood, impact and scale version. Link an active control with a code, description, effective date and owner. Have the Control Owner select that control for an assessment test. Ask the Independent Assurance Reviewer to compare the test date and assessment period with the control’s effective date. Then retire the control and confirm that the earlier test still points to the control that was actually examined.

• Active controls — Show current controls with their risk and accountable owner.
• Failed control tests — Trace a failure back to the control and its associated risk.

When a control changes, compare its effective date with the assessment period being examined. The owner should be able to explain why that control was selected and whether it was active at the time of testing. Keep the business unit link intact so a group review does not confuse one unit’s exposure with another’s.

See the related process and the record model before agreeing the pilot.