Risk and Control Management
Risk and Control Management is how you record the risks your organization faces, connect them to the processes and resources they threaten, and document the controls that mitigate them. Risk values update as you enter data, and mitigating controls reduce an inherent risk to its residual value.
Start here
- Risks and controls — the Risk, Risk Instance, Control, and Control Instance object types, their relationships, and their settings.
Work with risks and controls
- Add risks and controls — create the objects and record risk data.
- Residual risk calculation — how inherent risk, mitigating controls, and residual risk are calculated.
- Test control effectiveness — review how controls remediate a risk, adjust ratings, and report on the result.
- Assess a control — document whether a control is present, appropriate, and effective (Early Access).
ICS risks
- ICS risks — the Internal Control System risk type and how materiality is determined (Early Access).
- Work with ICS risk data — link risk-relevant objects and record ICS data points.
Related configuration
- Configure ICS risks — designate risk-relevant objects and set materiality thresholds.
- Risk and Risk Instance configuration — risk types, categories, the risk matrix, and risk ranges.
- Control and Control Instance configuration — control types, ratings, and weighting.
- Customize risk instructions — show your own guidance to people entering risk data.