CHALLENGES CONTROLNET ADDRESSES

LACK OF VISIBILITY OF CONTROL STATUS

Level one business owned controls are often captured on manual checklists or excel spreadsheets making it difficult to track when controls fail or aren’t executed on time. This is particularly difficult to manage when processes are offshore or outsourced or when teams are working remotely.

​

MI IS REACTIVE

MI is often produced after the end of the month, reporting on the risk events and errors that have occurred during the previous month. Often, the first time an organisation realises there was a control breach is when the risk event or loss occurs (or the client informs them).

​

LACK OF ACCOUNTABILITY FOR CONTROLS

When there is a control failure there is often a discussion about who should have performed the control check. 

​

SUPPORTING EVIDENCE

Supporting evidence, if provided, is often saved in shared drives, personal drives or sharepoint sites with no clear way to link to the control(s) to which it relates. 

​

REGULATORY PRESSURE

For regulated entities there is a need to demonstrate effective controls are in place. Individuals can be held personally accountable for control failings (e.g. Senior Managers and Certification Regime (SMCR).

​

RCSA SUBSTANTIATION (2nd line)

Auditors / Regulators are increasingly looking for substantiation to support the status of the Risk Control Self Assessments (RCSAs) submitted. 

MEASURABLE BENEFITS