How does iGRCs support this work?
Build a connected control library
Describe controls and recovery measures, identify owners and link safeguards to the relevant risks and assessment criteria.
Review design and operation
Use assessments and checklists to record what a control is intended to do and what evidence shows about its operation.
Act on weaknesses
Associate findings and corrective actions with the control concerned. Keep subsequent review evidence available to explain what changed.
What is the difference between control design and operating effectiveness?
Control design asks whether a safeguard could address the intended risk. Operating effectiveness asks whether it actually works as intended in practice. Useful assurance considers both, supported by appropriate evidence.
Which requirements are relevant?
Control reviews can support internal assurance, contractual requirements and relevant management system standards. The required control set and test criteria depend on your organisation’s risks and obligations.
Frequently asked questions
Can a control be linked to more than one risk?
A shared control may inform several risk assessments. Discuss the required relationships and reporting during configuration.
How do we handle a failed control test?
Record the finding, assign remedial work and retain the evidence needed for an accountable review of closure.
See iGRCs in action
Discuss your current process, the people involved and the evidence you need. We will demonstrate the relevant capabilities and explore an appropriate configuration.