CPS 230 para 26 Assessment of Business and Strategic Decisions on the Risk Profile
As part of business and strategic planning the entity must assess the impact of its business and strategic decisions on its operational risk profile and operational resilience, including the impact of new products, servi
3
artefacts
0
held by a system
3
at each review
hard
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Operational risk assessments embedded in strategic planning papers · Document repository
- New product, service, geography and technology assessments · Document repository
- Evidence the assessments changed the risk profile record · Document repository
governing documentDocuments that govern the control
none for this control
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Strategic planning without operational risk input
- New technology adopted with no resilience assessment
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetCPS 230 para 25 Information and Technology Capability and Asset Health · CPS 230 para 27 Comprehensive Assessment of the Operational Risk Profile