Skip to main content

Test control effectiveness

Check whether the controls on a risk actually work: inspect how they remediate the risk's values, adjust a control's rating when its effectiveness changes, and build the repeatable reports that document the result. Many organizations run a formal review like this annually or twice a year, and watch risk status continuously in between.

Control testing works on risks with the Standard data type, where linked controls reduce the inherent risk to the residual risk. It's separate from control assessments, which are text records and don't affect risk values — you can test control effectiveness without ever recording an assessment.

Prerequisites​

  • The PRC (Performance, Risk and Control) Module — see the License capability matrix.
  • View permission on the risks and controls you review, and Modify on a control to change its rating.
  • The risk holds Standard risk data and its controls are related through Controlled By — see Add risks and controls.

Steps​

Inspect the remediation on the risk​

  1. Open the Risk or Risk Instance and expand the Risk section of its main page. The summary row shows the current Inherent Risk, Combined Controls, and Residual Risk values.
  2. Expand the remediation table (click the empty space in the summary row) to see each linked control with its Control Rating, mitigation value, the key/non-key Control Weight Percentages, and how they combine into the residual value.
  3. Check category coverage: a warning next to the residual value means the controls don't cover all the risk's categories — select View Categories to see which categories lack a mitigating control.

The Risk section of a risk's main page, showing the remediation summary and the per-control breakdown with ratings and weights.

Update a control's rating​

When testing shows a control is more or less effective than recorded:

  1. Open the Control or Control Instance and select its Settings tab.
  2. Set the Control Rating to the level your test supports, and correct the Control Keying and Risk Categories if they no longer match reality. Settings save as you change them.
  3. Return to the risk — its combined control and residual values reflect the new rating. See Residual risk calculation for the math.

Report on risks and their controls​

Repeatable reports make the review observable across the whole repository, not one risk at a time — and for most audits, these reports together with the remediation tables on the risk objects are sufficient evidence. If your auditors need an external copy, export the list report to Excel.

  • A Generic List or Table report over risks shows values and linked controls side by side. Create the report with the type Generic List or Table, then copy these into its Filter and Properties fields:

    Filter
    type=ObjectType.RISK or type=ObjectType.RISK_INSTANCE
    Properties
    currentRiskData.inherentRisk currentRiskData.residualRisk risk:category isControlledBy

  • A Risk Map report plots objects by impact and likelihood — the management view of where risk concentrates. See Create a report and the Risk Map view options.

More patterns: IQL query samples (including a Risk Map example) and the currentRiskData entries in IQL query properties.

Verify​

After changing a control's rating, the risk's Combined Controls and Residual Risk values update, and a re-run of your list report shows the new residual value.