CC5.1 COSO principle 10: Selects and develops control activities to mitigate risks
Selects and develops control activities that contribute to the mitigation of risks to the achievement of objectives to acceptable levels.
5
artefacts
1
held by a system
3
at each review
hard
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- The control matrix or equivalent, showing the mix of control types including preventive and detective and manual and automated · Policy repository / GRC workspace
periodic reviewEvidence produced at each review
- Evidence of consideration of the relevant business processes and of the level at which each control applies · Document repository
- Evidence of segregation of duties considered in control design, and compensating controls where segregation was not practicable · Document repository
- Evidence controls were assigned owners responsible for their performance · Document repository
governing documentDocuments that govern the control
- Evidence control activities were selected in response to identified risks, traceable from the risk register to specific controls · Policy repository / GRC workspace
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your Policy repository / GRC workspace on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Controls listed with no traceability to any risk, so the entity cannot show they mitigate anything identified
- Detective controls absent, leaving no means to identify failure of the preventive ones
- Segregation of duties not considered in design, discovered only when the auditor tests it
- Controls owned by no one, so performance depends on habit
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetCC4.2 COSO principle 17: Evaluates and communicates deficiencies in a timely manner · CC5.2 COSO principle 11: Selects and develops general controls over technology