Paste your list of risks and your list of controls. The tool shows which risks have no control mapped, which high risks have fewer controls than you want, which controls have no owner or frequency, and which controls point to a risk ID that is not on the list.
A control can address several risks. Separate the risk IDs with a semicolon.
Coverage here means a control is mapped to the risk. It does not say the control is well designed or operating. Test design and operation separately.
| Risk ID | Risk | Process | Rating |
|---|---|---|---|
| R4 | R4 | Hire to retire | High |
| R5 | R5 | Record to report | High |
| High risk | Risk | Controls found |
|---|---|---|
| R3 | R3 | 1 |
| Control ID | Control without an owner |
|---|---|
| C2 | C2 |
| Control | Problem |
|---|---|
| C4 | Risk ID R6 is not on the risk list |
A risk with no control is a gap you must report or cover another way. A control with no owner has nobody to run it or answer for it. A control pointing to a risk that is not on the list was probably written for an old version of the matrix. Check coverage first, then spend your testing time on controls that exist and matter.
Each control names the risk IDs it addresses. A risk is covered if at least one control names it.
High risks are the ones whose rating matches the word you set. If fewer controls than your minimum point to one, it is shown as thin.
Controls with no owner, no frequency (if switched on), no risk ID, or a risk ID that is not on the risk list are listed as gaps.
Five risks are listed. Controls are mapped to R1, R2 and R3, one control names R6 which is not on the list, and R4 and R5 have no control.
