Controls and control assurance

Many practical aspects of risk management are really about creating and managing controls. Designing and implementing controls and having confidence they will work in the future if needed are critical aspects of risk management. This chapter describes important concepts and activities associated with controls, and particularly critical controls, those where failure might have a large impact on whether you can achieve important strategic or business objectives. It discusses forms of analysis to help you identify where improved controls might be needed and what you might focus on when you design them, including response controls for risks with high impacts, process controls for risks with high likelihoods, bow ties to identify control gaps, and control effectiveness to identify control improvements. It describes how to plan control assurance reviews and integrate them into normal business, including an annual business assurance cycle. It details a four-step process for conducting a simple control self-assessment to provide assurance about control effectiveness.