Risk and Control Management
Risk and Control Management is how you record the risks your organization faces, connect them to the processes and resources they threaten, and document the controls that mitigate them. Risk values update as you enter data, and mitigating controls reduce an inherent risk to its residual value.
Start here
- Risks and controls — the Risk, Risk Instance, Control, and Control Instance object types, their relationships, and their settings.
Work with risks and controls
- Add risks and controls — create the objects and record risk data.
- Residual risk calculation — how inherent risk, mitigating controls, and residual risk are calculated.
- Test control effectiveness — review how controls remediate a risk, adjust ratings, and report on the result.
- Assess a control — document whether a control is present, appropriate, and effective (Early Access).
ICS risks
- ICS risks — the Internal Control System risk type and how materiality is determined (Early Access).
- Work with ICS risk data — link risk-relevant objects and record ICS data points.
BIA risks
- BIA risks — the Business Impact Analysis risk type, its time-based impact assessment, and business criticality (limited availability).
- Work with BIA assessments — fill in, submit, confirm, and board-review an assessment.
Related configuration
- Configure ICS risks — designate risk-relevant objects and set materiality thresholds.
- Configure BIA risks — set the criticality threshold column for BIA assessments.
- Risk and Risk Instance configuration — risk types, categories, the risk matrix, and risk ranges.
- Control and Control Instance configuration — control types, ratings, and weighting.
- Customize risk instructions — show your own guidance to people entering risk data.