Risk Assessment
RA-02Assess the control environment and derive residual risk
How Leela would run itAnnual · with each assessment, and whenever a control is added or fails
From the policy libraryThe requirement
Each control that mitigates an identified risk is listed with its status and adequacy, including controls not yet implemented, and residual risk is derived per dimension and for the program overall.
- Applies
- Tell Leela about your company to see whether this applies.
- Status
- Setup needed
Tell Leela how you handle it today, or hand it over: see what’s next.
The work
Build the control table with status and adequacy, adjust each inherent rating for control effectiveness, and state the overall residual rating and the dimensions driving it.
What Leela keepsThe evidence this obligation leaves, as the work happens
Listed from the policy libraryContents
- 01Control assessment and residual rating tableInherent, control effectiveness, and residual rating per dimension
Evidence
Control assessment and residual rating table
Risk Assessment §5, §6
1
of 1 record
The work and the records come from this obligation in the policy library.