Does your control work? Start with the evidence
“Control in place” can mean several things. A procedure may have been written, equipment installed, or training delivered. Those facts matter, but they do not tell us whether the control achieves its purpose in the conditions that matter.
A useful assessment starts with a more precise question: what is this control meant to do, and what evidence would show that it does it?
Define the purpose before assigning a rating
Take a fictional purchasing process. Its approval control is intended to stop orders above a defined amount being committed without the required authority.
That purpose gives the assessor something to examine. “Approvals exist” is too broad. Which transactions require approval? Who has authority? Can an order bypass the normal route? Does an approval occur before the commitment is made?
You can organise the assessment around three questions:
Design: Could the control address the intended scenario? Examine the approval rule, delegated authority and handling of exceptions.
Implementation: Has the intended control been put into use? Examine system configuration, assigned responsibilities and instructions available to users.
Operation: Does it work under the conditions assessed? Examine transaction records, observed practice and a suitably designed test.
The evidence should fit the claim. A policy document can describe the intended rule. It cannot, by itself, establish that people follow it.
Examine the whole chain
A control can depend on other controls and on supporting resources. An approval workflow may rely on correct user permissions, current delegations and reliable transaction data. A warning may depend on someone receiving it and having authority to act.
Ask what happens when those dependencies are unavailable or wrong. Consider normal work, relevant exceptions and the conditions in which the control is most needed. The question is not simply whether more controls are listed; it is whether the combined arrangements address the scenario.
Avoid claiming more than a test shows. If you review a sample of transactions, record how it was selected and which conditions it covers. A successful sample does not establish that every transaction, period or exception is covered.
Keep “unknown” separate from “effective”
Sometimes the evidence is missing. That is a useful finding.
Write what you know, what remains uncertain and what evidence is needed next. Do not turn “no failure was reported” into proof that the control works. Equally, missing evidence does not prove the control has failed.
Use explicit rating criteria. Categories such as fully, substantially or partially effective can help organise findings when their meaning is clear. They are ordered descriptions, not automatic percentages of risk reduction. Averaging several ratings can conceal a dependency or a serious weakness.
Connect the finding to a decision
A strong effectiveness rating is not the same as acceptable remaining risk. The control could perform as designed and still leave exposure that needs a separate decision against the organisation’s criteria.
For one important control, create this short record:
Purpose: What the control should achieve.
Conditions: Where and when the assessment applies.
Evidence: What was inspected or tested, and what was found.
Uncertainty: What the evidence does not establish.
Action: What needs to change or be checked next, with an owner and review date.
That record gives the next person a basis for action and a way to revisit the judgement when conditions change.Based on section 5.4.3.8 of Risk Management Body of Knowledge, by Julian Talbot, Jason Brown and Miles Jakeman, AM. The purchasing example is illustrative.
Put the body of knowledge to work
Explore the Risk Management Body of Knowledge for the connected principles, frameworks and methods behind this article.
Considering a shared reference for your team? Enquire about organisational use and tell us how you would use RMBOK.