Platform / The governance core

Controls

One control usually covers several risks. In a spreadsheet it is described several times, assessed several times and kept up to date in one place and not the others. Here it is maintained once, and a change reaches every risk it touches.

A control in the library: its assessment history and the four risks it mitigates A drawn view of the platform. On the left, one control, daily client money reconciliation, with its type, frequency and owner, and three dated assessments beneath it, each rating design and operating effectiveness separately with the assessor's initials. On the right, the four risks the control mitigates, each with its residual score. Connected risk intelligence All entities (Group) Dashboard Risk register Risk assessments Controls Control assessments KRI register KRI collection Breaches Risk events Remediation Committee packs Audit log MODULES TPRM & Supplier DD Obligations Management ICARA Operational Resilience Customer Oversight Portal RMRisk manager Daily client money reconciliation KEY Control · detective · daily · owner named · next assessment due 30 Jun Record assessment Assessments Every one stays on the record DATEDESIGNOPERATINGASSESSOR 30 Mar Effective Effective RMsecond line 30 Dec Effective Partially effective COsecond line Two exceptions in the month, both cleared within a day. Remediation action raised and since closed. 30 Sep Effective Effective RMsecond line Design effectiveness Is it the right control for the risks it is meant to mitigate? Operating effectiveness Is it actually working, as at the date of the assessment? Assessed separately, because "the control works" is an opinion until it has a date and an assessor attached to it. Mitigates 4 risks 9 Client money reconciliation failsOperational · within appetite 6 Misposted transactionOperational · within appetite 6 Unauthorised transferConduct · within appetite 4 Late regulatory returnRegulatory · within appetite Maintained once. A change to this control reaches all four. A change to any of them writes to the audit trail.

Drawn from the platform.

What changes

One control can cover four risks and be maintained once. Design and operating effectiveness are assessed separately, every assessment carries a date and an assessor and last year's judgement is still there when somebody asks what changed.

One control linked to four risks A single control, daily reconciliation, assessed effective for design and effective for operation, is joined by four lines to four separate risks on the register. A caption says it is maintained once and a change reaches all four. CONTROL Daily reconciliation Design Operating Assessed, dated, by name Client money shortfall Misposted transaction Unauthorised transfer Late regulatory return Maintained once. A change reaches all four.
A control in the library, linked to the risks it mitigates.

In detail

Three rows from the controls library in the demonstration organisation, each showing a design rating, an operating rating and the date the next assessment is due
Design and operating effectiveness, side by side, with the next assessment date. Demonstration data.

Controls sit in a library and link to the risks they mitigate, so a control that covers four risks is maintained once rather than four times, and a change to it reaches all four.

Controls are assessed through control self-assessment by the person who owns them, with an independent review by the second line where the framework calls for one, and the record says which kind each assessment was. Design and operating effectiveness are assessed separately, and every assessment stays on the record with a date and an assessor, so last year's judgement is still there when somebody asks what changed and why. An assessment that finds a control ineffective can raise a remediation action directly, so the finding and the response are linked from the start.

The evidence it leaves behind

Every assessment is a dated entry by a named assessor, and every change to a control writes to the audit trail. How the record is protected

Previous: The risk register Next: Indicators

See it against your own controls

Tell us how your controls are recorded today and we will walk you through the platform against that.

Request a walkthrough Follow one risk end to end

or write to sales@puretrace.co.uk