Understand · 1 of 4Self-paced
Test whether a control works
A risk register records a risk; a control changes its likelihood or consequence. Preventive, detective and recovery controls act at different points. Assurance requires evidence of operation and effectiveness, not just policy existence.
Read · work through an example · try it yourselfWatch the video
Working relationship
Risk → control → owner → evidence → test frequency
What to keep separate
Do not equate the number of controls with residual risk reduction.
Your task
Design one preventive and one detective control for a settlement-data error and specify an effectiveness test.