Add a control to a risk

  • Release version: Australia
  • Updated March 12, 2026
  • 1 minute to read

    • Controls are added to the risks for the on-going review of processes.

    Before you begin

    Role required: sn_risk.manager and sn_compliance.manager

    About this task

    Procedure

    1. Navigate to All > Risk > Risk Register > All Risks
    2. Open the risk record from the list.
    3. Continue with one of the following options.
      OptionDescription
      Add an existing control
      1. In the Controls related list, select Add.
      2. Select the controls that are associated with the risk profile.
      3. Select Add relationship.
      Note:
      The controls displayed after selecting the Add button are limited to controls where the entity of control matches the risk entity. If there are no eligible controls that can be related to the risk, the Add button isn’t displayed on the Controls related list.
      Add a new control
      1. In the Controls related list, select New.
      2. On the form, fill in the fields. For a description of the field values on the Control form, see Create a control.
      3. Select Submit.
      Inherit common controls
      1. In the Controls related list, select Inherit common controls.
      2. Select the controls.
      3. Select Add.
      Note:
      The common controls displayed after selecting the Inherit common controls button are limited to controls where the reliant entity of control matches the risk entity. If there are no eligible controls that can be related to the risk, the Inherit common controls button isn’t displayed on the Controls related list.
      • When a control objective and risk statement are associated and the control entity matches the risk entity, the risk-control association is created.
      • The risks and controls that are created after associating a control objective to the risk statement aren’t associated with the risk statement immediately. They get associated when the GRC Profile Generation scheduled job runs.
      • If you manually delete a control from a risk, the control won’t be re-created by the scheduled job. You must manually create it again if necessary.