Risks and controls
This page is an overview. Step-by-step instructions will be added.
- Define the organization's risks and the control activities that address them, and link them. The system then shows which control covers which risk, which risks have no control and which controls serve several risks.
- Risks and controls are classified by COSO component, category and related criteria.
- Controls are assessed for design and implementation, with supporting evidence stored for each assessment.
Risk states
Each risk is tracked in three states:
| State | Meaning |
|---|---|
| Inherent risk | Exposure before any control activity. |
| Risk with controls before testing | Exposure after the designed controls, before they are tested. |
| Residual risk | Exposure after the controls are tested. The basis for the audit response. |
Comparing the three states shows where controls reduce exposure and where they exist only on paper. The reasoning for each assessment is documented.