Select Related Controls

You can relate controls to a risk in the Related Records panel of the page to create or edit the risk, or the Related Controls panel of the page to create or edit a treatment plan for the risk.

If you add controls as you define the risk, those controls belong to the risk's In Use treatment plan. If you add controls as you define a plan, those controls belong to the plan you're defining, no matter what Usage value, if any, it has.

No matter where you select related controls, the procedure is the same. You can designate a control as primary, or you can make it subordinate to a primary control. You can also assign a stratification value to each control, to define its distinct purpose in relieving the risk.

Do either of the following:

• Click the Add Primary Control button. In an Add Control page, select any number of controls. You can use the Ctrl or Shift key to select a discontinuous or continuous set of controls. Then click Done (an icon that looks like a less-than symbol).
• Select the row for a primary control, click the Add Subordinate Control button, and select any number of controls from the Add Control page. When you select Done, the subordinate controls appear indented beneath the primary control you selected.

Then, in the row for each control, select a value from the Stratification list of values:

• Key: A control of significant importance to the proper operation of a business process.
• Mitigating: A control that serves to eliminate risk for a process.
• Monitoring: A control that monitors one or more related controls.
• Compensating: A control that addresses weakness in a related control.
• Redundant: A control that implements the same regulation as a key control.

To dissolve a relationship, select the row for a control and then select the Delete icon. (The control continues to exist. Only its relationship to the risk is deleted.) To remove a primary control, you must first remove all its subordinate controls.