Skip to content
Docs

Controls and control testing

Each risk records the controls that reduce it. The effectiveness of those controls is what turns inherent risk into residual risk, and control testing checks that the controls work as recorded.

Who may do it: the Risk Champion for their own team’s risks; the Entity Risk Manager for the whole entity. See Roles and permissions.

Control effectiveness and residual risk

Section titled “Control effectiveness and residual risk”

Each control on a risk carries an effectiveness assessment. The system takes the risk’s inherent score and the effectiveness of its controls and computes the residual score, tier and band. Residual risk is never higher than inherent risk. See Scoring a risk.

Recording a control

Section titled “Recording a control”
  1. Open the risk.
  2. Add the control and describe what it does.
  3. Assess its effectiveness.
  4. Save. The residual score updates.

Testing a control

Section titled “Testing a control”
  1. Plan the test. On the control, create a test plan: what will be tested, how, and when.
  2. Record the result when the test is done: passed or failed.
  3. Record the findings — what the test found.
  4. A failed test creates an action item in the action register, with an owner, a due date and a status. Findings that need follow-up also go to the action register.

What the system does or refuses

Section titled “What the system does or refuses”
  • Creates the action item for a failed test automatically; nobody has to re-key it.
  • Records who and when on every test plan, result and finding. See Who-filed is stamped.
  • Keeps the history. Earlier test results stay on the control.
  • Refuses changes from outside the entity. A parent user reads the controls and test results of a subsidiary and cannot record or change them. See Subsidiary-Independence.
Section titled “Related”