Controls

A single controls register spanning financial, compliance, operational, IT, and process controls — the same way the RAID log covers all four RAID categories.

AI in this module

How AI suggestions work

Click "Get AI Suggestions" to draft or improve the Overview and Controls Register together in one pass, grounded in the DRP's other content (especially the RAID log) and any AI Knowledgebase documents.

The AI will only name a Related Risk or Requirement it can actually find elsewhere in the DRP — expect that cell to be left blank rather than guessed when no clear link exists.

Quality checks

What "Check Quality" looks for here

Genuine Type/Domain classification. Flags a repeated, defaulted-looking combination instead of real differentiation between controls.

Real related-item references. Cross-checks each Related Risk or Requirement against this DRP's real RAID log entries and linked requirements — the same real-record verification used for Traceability Matrix and Test Cases, not just a plausibility check.

What it captures

A single controls register spanning any domain — financial, compliance, operational, IT, or process — the same way the RAID log covers all four RAID categories in one table.

Using this module

This module has two parts: an Overview — a short summary of the overall control environment — and a Controls Register table, where each row is one control classified by Type and Domain.

  1. 1Use "+ Add row" to add a control, and the ✕ on a row to remove one.
  2. 2Set Type (Preventive/Detective/Corrective) and Domain (Financial/Compliance/Operational/IT/Process) per row — don't default every row to the same values.
  3. 3Set Owner (who's actually responsible) and Frequency (how often it's performed or checked, e.g. "Continuous", "Monthly", "Per release").
  4. 4Use Related Risk or Requirement to name a real item from the RAID log or Requirements this control addresses, where one genuinely exists.
  5. 5Set Status (Planned/Implemented/Effective/Needs Remediation) and keep it current — a control still marked "Planned" long after it should be live is worth noticing.

Review and approval

Reviewed as a whole — the Overview and the Controls Register together, in one sign-off. Once submitted it is read-only; to change it, press "Reopen to edit", which cancels the round and returns it to In progress.

This DRP's Review Assignments tab shows the module as one row, like any other, with its own review level, reviewers and approver — inherited from the project until you change them here.

Tips

  • "Export CSV", at the top of the page, downloads this table as a spreadsheet file — handy for sharing it with someone who works in Excel.
  • Most useful once the RAID log has real risks in it — a control without a risk or requirement behind it is usually a sign the register is being padded out.