INDICATORS, CONTROL & RISK OWNER ( ENTITY OWNER )

[Damon12]

Hi

Can someone please give me a better understanding of indicators, Probably a layman's explanation 

Are control and risk owner mandatory, are they the ones to oversee the attestation and assessment 

can the control owner and risk owner be the same as attestation and assessment respondent

why is the entity owner the same as the control and risk owner

[Eric Feron]

Indicators help you make sure that all is up to scratch, or know what is not, before the audit comes. They "indicate" the condition of your world.

Ideally they are automated.

Think about:

• The check-lights on your car dashboard (automated indicators).
• Actually checking oil level or tire pressure at the gas station (manual indicators).
• Before the scheduled service (audit).

Happy driving 🙂 

We are preparing a quick video tutorial on Indicators. It will be posted here (Subscribe to that forum to get the alert).

[Richard Rivett]

What the risk community refers to as "Control Effectiveness". This means has the control been designed correctly so you will often hear the terms such as "Design Effectiveness". 

Using another everyday example. If the Risk is "Intruder entering your house", then a control could be a door with a lock. However, if people forget to close the door or worse still forget to lock it and an intruder gains entry, then Control is ineffective and therefore badly designed. Once again an "Issue" should be raised with "Action Plan(s)" created to address this. This could result in the Control being updated to include an auto closer on the door and a handle only on the inside i.e. the Control is redesigned. Or potentially people need to be trained or agree to shut the door i.e. creation of a Policy and the attestation of said policy. 

Hopefully, I am starting to lift the lid on the interrelationships between the different components of Risk and how all these different elements come together.

On your Audit point @Eric Feron, absolutely, and "the business" who owns the controls should also be wary of the other assurance functions who will undertake independent control tests to determine effectiveness. Mainly the preserve of banks, I have seen dedicated testing teams within Operational Risk and Compliance who spent their time "auditing" (I only ever made the mistake of calling Compliance testers "auditors" one - they were not assumed 🙂

They, of course, look at it through their very specific lense, hence why having the core data in place aids Integrated Risk Management (or maybe that's GRC if the rumours are to be believed) but that's a completely different topic worthy of a dedicated discussion. 

For now, I will not try and hijack this one!

[Eric Feron]

Damon, you now have a whole panel of explanations from all possible angles! 🙂

Does this all work for you?