Add and Manage Controls

Within the Risk Control Matrix, you can add and manage controls that mitigate specific risks. Controls are designed to reduce the identified risks to an acceptable level and provide reasonable assurance that the defined objectives are met.

Access the Entity Hierarchy
1. Select the Default GRC context from the context menu.
2. Click the GRC Register tab.
3. Select Entity Hierarchy from the Frameworks group.
Add Controls
1. Right click on the RCM where you wish to add the object, click Add Object and select Control.
  OR
2. Double-click the RCM you wish to view or right-click and select View Object. The RCM page will appear in the window on the right-hand side of the screen.
3. Click Add in the Controls section to link controls to this process through in-line editing or click Add to open the Control form in a separate window.
  Note: See In Line Editing for additional information.
  
  In Line View
  
  Control Form
4. Enter the Control Name and Description.
  Note: Do not utilize the following characters when entering information into Portal; & * % # @ ; / \ : , - or ~. .
5. Select Control Type1, Control Type2, Significance, COSO Element, and Control Frequency from the drop-down values.
6. Click Select User or Select User Group to choose an owner for this control
  - Enter text that contains the name, email address or network ID of the user you wish to select and click Execute or click Show All.
    Note: A list of users containing, (not equaling), the entered text will display in the search results.
  - Click the name of the user or click Select No User to indicate the user is not required.
7. Click Save or Save.
  Note: The controls are added to the list.
Evaluate Controls via in line editing
1. Double-click the RCM for the entity, or right-click and select View Object.
2. Scroll to the Controls section and click Edit next to the name of the control you wish to evaluate.
  Note: Click Edit All to place all listed controls in edit mode at the same time.
3. Select the control evaluation from the drop-down list.
4. Update any additional information that is displayed as necessary.
5. Click Save.
Note: Click Save All if the Edit All functionality was utilized.
Evaluate Controls via the Control Evaluation Form
1. Expand the Control folder in the RCM for the selected entity.
2. Double-click the control you wish to edit, or right-click and select View Object.
  Note: You can also access the control from the RCM form..
  1. Double-click the RCM or right-click and and select View Object.
  2. Click the name of the control you wish to evaluate from the control list
3. Click Edit in the Evaluation section complete the evaluation information.
4. Select the Operating Effectiveness and Evaluation Type from the drop-down list.
  Note: It is likely that your Operational Effectiveness evaluation will come after assessment of design and performance of testing.
5. Click Select User or Select User Group to enter the name of the evaluator. There are three options:
  - Enter text that contains the name, email address or network ID of the user you wish to select and click Execute or click Show All.
    Note: A list of users containing, (not equaling), the entered text will display in the search results.
  - Click the name of the user or click Select No User to indicate the user is not required.
6. Enter the Evaluation Plan.
7. Enter the Evaluation Results.
8. Enter any Comments.
9. Select a status and period from the drop-down list.
10. Enter the evaluation date.
  Note: The Control Evaluation information may be updated at a later time by selecting Edit beside the control to be edited on the Process Control form.
11. Click Save.
Link Existing Objectives, Risks and Tests to Controls
1. Right-click on the control that you wish to link from the entity hierarchy, click Link Object and select Objective, Risk or Test, depending on which object you wish to link.
  Note: You can also link risks and tests from the Control form.
  1. Double-click the control or right-click and select View Object. The Control form will appear in the window on the right-hand side of the screen.
  2. Click Link in the Objective. Risk or Test section, depending on which object type you wish to link.
2. Mark the checkboxes next to the objective, risk or test you wish to link from the list, depending on the object you selected.
  Note: Click Edit Search and utilize the list search functionality to modify your selection and focus your results. Utilize List Searches for more information.
3. Click Save.
Add New Objectives, Risks, and Tests to Controls
New objectives, risks and/or tests can be linked to a given control.
1. Right-click on the control that you wish to link from the entity hierarchy, click Add Object and select Objective, Risk or Test depending on which object you wish to add.
  Note: You can also add risks. controls from the Control form.
  1. Double-click the control or right-click and select View Object. The Control form will appear in the window on the right-hand side of the screen.
  2. Click Add in the Objective, Risk or Test section, depending on which object type you wish to add.
2. Fill out the object form and click Save. The new object will be added to the RCM and linked to the control.
Note: See Add and Manage Objectives, Add and Manage Risks or Add and Manage Tests for more information on filling out the forms for the specific objects.
Control Quick Reports
See Quick Reports for additional information on generating, adding, editing and deleting Objective Quick Reports.

Note: The control quick report link must be configured to display. For information on adding the Quick Report link to the form, see Configure a form.

Note: Administrators can configure fields in the Control form to update a field based on a specific value of another field or fields. See Configure a Calculated Field for details.