In Risk Manager, select the Controls tab at the top to open the controls summary page containing a table that lists all controls. Select a control to view its details on the control detail page.
The control detail page is where you manage an individual control: its attributes, evidence sources, linked risks, assurance records, and review cycle. This article covers all fields and actions available on a control.
The top of the control detail page displays the control title with chips indicating the control category, type, effectiveness and status.
A numbered badge will appear next to Risks and Evidence Sources to indicate the number of risks and evidence sources linked to this risk.
Add a Control
Select the Controls tab.
Select Add. The Add Control card opens up.
Fill in the title, description and link a form if needed. On the Properties tab, set the review cycle, review date, business continuity and access if needed.
Select Add Control. The new control will be listed in the Controls table.
Edit a Control
Select the Edit Details button to edit the control's: title, owner, business area, category, type, effectiveness and review cycle.
Select the Edit Control button to edit the control's: title, description, tags.
Linked Risks
Select the Risks tab to see all risks connected to this control:
The table displays the risk title, category, inherent rating with residual rating, owner, status.
Select a risk to open its details.
Click Link Risks button to open a modal showing available (unlinked) risks
Select a risk and save — the linked risk count increments
Deselect the risk to remove the link (the risk itself is not deleted). Select Save.
Evidence Sources
Evidence sources document the proof that a control is operating effectively:
Open a control to view its details page
Select the Evidence Source tab
Click Add Evidence Source
Select the source type (process, managed document, attachment, external link, text instruction), enter a title/label, description, select whether it's required for assurance, and the other required detail.
Select Save. The new evidence source appears in the list
To edit or delete the evidence, select the corresponding icon that appears next to the entry. Select the evidence to open it.
Assurance Recording
The Review History tab opens the Current Control Assurance table.
Review tasks and review history are listed here.
Select View Task button to view the upcoming review tasks.
Select Add Assurance button to log reviews that have been done and add an entry in the Control Review History table. This table displays the following:
review date
signed off by (user)
signed off on date
result
timing (if the review was completed early)
evidence (if any was uploaded during the review)
comments (if any was added during the review).
Assurance history is ordered by date descending.
Sign-Off
When a review is due, a sign-off button appears:
Click sign-off to record the review
The next review date advances based on the cycle
The sign-off appears in the review history
Ineligible users will see the button disabled or hidden.
Activate a Control
All controls need to be activated once they are ready.
Activate: requires title, description, category, and type. Validation errors appear if required fields are missing.
Deactivate: changes status to Inactive. Control data is not deleted.
Further Information
For health indicators, see Control Health. For the control summary table, see Managing Controls. For linking risks, see also Risk Details.