Risk and control self-assessment, every quarter.
Each department, unit and team keeps its own risks, controls and test cases. Every quarter it tests itself, another unit re-performs a sample, and the second line challenges or signs off. Internal audit adds its own results on the same tests. AuditHD keeps the four views apart, so you can see where they disagree.
Four views of every control, kept apart.
Each layer records its own result. Nobody overwrites another layer's work, and every result keeps its sample, exceptions, notes and evidence.
Self-assessment
The unit runs its own tests, records the sample and exceptions, attaches evidence and rates residual risk. The head of the unit attests the result.
Peer assessment
Another unit re-performs a sample of key-control tests. Peers rotate each campaign: no unit assesses itself, and the pairs change from quarter to quarter.
Second-line challenge
Risk management returns an assessment with a reason, or signs it off once the peer review is complete. A campaign closes only when every unit is signed off.
Internal audit
Auditors record their own results on the same tests, without changing what the unit, the peer or the second line recorded.
Disagreements in plain sight
Wherever another layer rates a test worse than the unit did, it is counted and listed, by unit and by control.
Failures become issues
A failed test becomes a finding with an owner, actions and due dates, followed up in the same register as audit findings.
Each unit owns its register.
Units maintain their risks, controls and tests; the second line maintains the shared risk taxonomy that everyone classifies against.
- Taxonomy from the Basel operational-risk event types, with regulatory compliance and Shariah non-compliance categories; add your own
- Controls by type (preventive, detective, corrective), nature (manual, automated, IT-dependent), frequency and key-control flag
- Test cases with steps, pass criteria, evidence required and sample size
- Inherent and residual risk on a five-by-five scale; residual risk cannot be rated above inherent
Quarterly campaigns
Pick the units, the period and the peer sample size. Opening a campaign fixes each unit's assessment and peer sample.
Excel register
Per campaign: unit status and sign-off, control results by layer with exceptions and notes, and residual risk by unit and by the second line.
On the audit trail
Every result, rating, attestation, challenge and sign-off is recorded in the same tamper-evident trail as the rest of the audit work.
From RCSA to MARS™.
Every control failure the RCSA turns into an issue, with its residual risk, goes into the MARS™ register next to internal audit findings and management's own. Unit heads acknowledge them, and when an external auditor or regulator arrives, the register shows what management already knew.
See it with your own checklists.
Open the live demo now, or book a walkthrough and we will load one of your frameworks or work programmes.