Control assurance from risk to remediation
Links risk treatment to operating evidence, independent testing and verified remediation. Original worked design example; adapt responsibilities, thresholds and assumptions to your system.
What this template contains
- Graph
- Directed
- Edges
- 10
- Source
- 24 lines
Make it your own.
digraph G {
graph [rankdir=LR, bgcolor="transparent", pad="0.3", nodesep="0.45", ranksep="0.8"];
node [shape=box, style="rounded,filled", fillcolor="#edf4fa", color="#47728d", fontname="Arial", fontsize=12, margin="0.14"];
edge [color="#64748b", fontname="Arial", fontsize=10];
risk [label="Risk register"];
control [label="Control design"];
owner [label="Control owner"];
evidence [label="Operating evidence"];
test [label="Assurance testing"];
finding [label="Findings"];
action [label="Remediation actions"];
residual [label="Residual risk"];
committee [label="Oversight committee"];
risk -> control [label="addressed by"];
owner -> control [label="accountable"];
control -> evidence [label="produces"];
evidence -> test [label="sample basis"];
test -> finding [label="exceptions"];
finding -> action [label="assigned response"];
action -> test [label="closure verification"];
test -> residual [label="assurance input"];
residual -> committee [label="risk decision"];
committee -> risk [label="accepted or revised appetite"];
}