Controls
Maintain the control library and rate how well each control works where it is linked.
9 min read9 sectionsAll roles (deleting a control is owners and admins only)
The Controls register is your library of safeguards — the checks, processes and technical measures that manage your risks and meet your obligations. A control has no single effectiveness score: it is rated separately against each risk and obligation it is linked to.
Open Controls from the sidebar to see every control you have access to.
Each row shows Key, Title, Classification, Shared, Description, Effectiveness (by linkage), Type, Implemented, Next Review and Linked, followed by the row actions. The Key stays pinned on the left when you scroll sideways.
Search controls…
Matches a control's title or key.
All units
Narrows to one organisational unit. Shown when your organisation has more than one unit.
All types
Filters to Preventative, Detective or Corrective controls.
Sort
Sort: Title (default), Sort: Type, Sort: Effectiveness (by linkage) or Sort: Implemented.
The Shared column shows a Shared chip when a control is also visible to other organisational units; hover it to see which. The Linked column counts the risks, obligations, evidence and incidents linked to the control. Click a count to open that register filtered to those records, or open Details or View to see them listed.
A control is rated against each risk and obligation it is linked to, never on its own.
The same control can work well against one risk and poorly against another, so each link carries its own rating. A control's rating for an obligation is also independent of its rating for any risk.
The Effectiveness (by linkage) column summarises the spread of those ratings, strongest first — for example 2 Effective · 1 Partially Effective · 1 unrated. Only links to risks and obligations you can see are counted.
- unrated
The control is linked to a risk or obligation, but nobody has rated that link yet.
- No linkages
The control is not linked to any risk or obligation you can see, so there is nothing to rate.
Sort: Effectiveness (by linkage) lists controls whose rated links are all Effective first, then those with some Partially Effective links, then any with an Ineffective link. Controls with nothing rated come last — no rating is not treated as a bad rating. Within each group, controls with more Effective links come first (in the Ineffective group, fewer Ineffective links come first), then the one with the strongest single rating, then title order.
Ratings come from your organisation's own scale, so your labels may differ from the defaults below.
The default scale
- Effective
Well designed, consistently implemented and operating reliably.
- Partially Effective
Reduces the risk, but design or operating gaps limit how reliable or complete it is.
- Ineffective
Does not mitigate the risk in any meaningful or reliable way.
Owners and admins manage the scale at Settings → Control Effectiveness Scale. You can start from the Simple (3 levels) or Advanced (5 levels) preset, or build your own. Each level has a name, colour, optional description and a Reporting band — Effective, Partially Effective or Ineffective — that decides how it is grouped in summaries and in the effectiveness sort.
Control Effectiveness Scale
Edit your organisation's rating levels.
You rate a control from the risk or obligation it supports, not from the control itself.
From an obligation
In New Obligation or Propose Update, use Linked Controls → Add controls..., then pick a rating beside each control. Applied when the proposal is approved.
From a risk's form
The risk form's Linked Controls picker works the same way. Applied when the proposal is approved.
On a risk's page
Owners and admins can Link a control, change a rating or unlink a control in the risk's Linked Controls card. These changes apply immediately, without a proposal. A control linked here starts Not rated until you pick a rating from the dropdown.
New controls are proposed first and appear in the register once an owner or admin approves them.
- 1
Click New in the top bar
Then choose Control from the type buttons at the top of the form.
- 2
Fill in the form
The AI Assistant panel beside the form can help you draft it.
- 3
Click Submit (propose)
Then confirm with Submit to Queue. You are taken to the new proposal.
- 4
Wait for approval
An owner or admin reviews it on Proposals. See the Proposals guide.
Create form fields, in order
- Title
The control's name, e.g. Separation of duties.
- Organisational Unit
The unit that owns the control. Defaults to your root unit.
- Also visible to
Other units that can view and link to the control. Only owners and admins can set it; only the owning unit can edit the record.
- Control Typerequired
Preventative, Detective or Corrective. Defaults to Preventative.
- Owner
The person accountable for the control.
- Description
What the control does.
- Control Category
A category and optional subcategory from your control taxonomy, if your organisation has set one up.
- Implemented Date
When the control was put in place.
- Review Frequency
Daily through Every 3 Years, Ongoing or As Required. Starts at Not set.
- Next Review Date
When the control should next be reviewed.
- Classification
Public, or Confidential — visible only to people with Confidential access.
- Linked Risks, Obligations, Evidence, Policies, Incidents, Treatment Plans
Related records. Links to risks and obligations start unrated.
- Additional Information
Optional notes for the reviewer.
Each row has three actions.
Details
Expands the row in place (click Hide to close). Shows the description, business unit, a count of links at each rating level with Not yet rated and Derived from N linkages, owner, category, type, status, review dates, and linked risks, policies, obligations and evidence.
View
Opens the control's own page. See The control page.
Propose Update
Opens Edit Control. Change any field and click Submit Update (propose); the change applies once it is approved.
The edit form adds a Status field — Active, Inactive or Planned — that the create form does not have, and labels the owning unit Business Unit. It has no effectiveness field, because ratings live on each link.
Click View to open a control's page.
The page shows the control's classification, its Control Details (type, effectiveness by linkage and status), its Review Schedule and its Linked Items. The rating badge beside each linked risk or obligation is this control's rating for that record alone.
The action row has ← Back to Controls, Propose Update and, for owners and admins, Delete. On a control shared into your unit from another unit, Make your own also appears: it opens the create form pre-filled as a copy for your unit, with no links carried over.
Evidence shows that a control is in place and working.
From the control
Use the Linked Evidence picker on the create form or in Propose Update.
From the evidence
On the Evidence register, click Link (propose) on an evidence row.
Either way the link is a proposal and applies once approved. Linked evidence then appears under Linked Items on the control.
Export CSV downloads the rows your current search and filters show.
The file includes type, owner, primary and secondary control category, review dates, classification, organisational unit, Raised By, each linked record as KEY — Title, and an Effectiveness By Linkage column with the same spread the register shows.