Action register
Every follow-up in Risk Core lands in one action register: from a failed control test, a Red KRI, a loss threshold review, a single point of failure, an exercise finding, an incident lesson or a management review decision. Each action has an owner, a due date and a status, and links back to where it came from.
Who uses it: everyone with actions sees and updates their own. The Entity Risk Manager sees every action of their entity. Executives and the RMC read their entity and everything beneath it. See Roles and permissions.
Where actions come from
Section titled “Where actions come from”| Source | Created when | Page |
|---|---|---|
| Control test | a test fails | Controls and control testing |
| KRI | an observation falls in the Red band | Observations and breaches |
| Loss event | a threshold review is flagged | Materiality tiers |
| BIA | a single point of failure has no workaround | Dependencies |
| Exercise | a finding is recorded | Exercise log |
| Incident | a lesson is recorded after closing | Closing an incident |
| Management review | a decision is taken | Management review |
Work an action
Section titled “Work an action”- Open Actions. Your own open actions are listed first, with those past their due date on top.
- Open an action to see its source, owner, due date and history.
- Choose In progress when work starts, and add notes as it moves.
- When it is done, choose Close and write what was done; attach evidence if you have it.
The Entity Risk Manager can change an action’s owner or due date; each change is kept in the action’s history.
Statuses
Section titled “Statuses”Open → In progress → Closed. An action past its due date and not closed is shown as overdue, with the days overdue, on the action list, the executive summary and the management review.
What the system does or refuses
Section titled “What the system does or refuses”- Every action keeps its source. It links back to the test, KRI, loss event, BIA activity, exercise, incident or review that created it, and cannot be deleted.
- Closing needs a note of what was done.
- Each company owns its actions. A parent reads its subsidiaries’ open and overdue actions through report-up and never creates, edits or closes them (Subsidiary-Independence).
- Every change is recorded in the audit log.