Risks and controls

Most risk registers can say a control exists. Automize can show it ran, because the processes that carry out your controls run here. Link a control to a process or a step, and every run becomes evidence that the control operated.

Risks and controls are on plans that include Risk and control registers. Open Risks or Controls from the menu. Register overview at the top of either page shows the whole register on one page.

1. Start your register

On the Risks or Controls page, open the menu next to Add and choose Import from a spreadsheet. You can:

• Upload your own register as an Excel file with a Risks sheet, a Controls sheet, or both. Use Download the template for the column names. Click Check to see what would change without changing anything, then Import. Rows are matched on their Ref, so uploading the same file again updates rows instead of adding copies. Nothing is written while any row has a problem.
• Start from a template: Accounting firm, POPIA essentials or ISO 27001 starter. Click Add it, or Download to edit first. Adding one again only adds what is missing; it never changes what you already have.

You can also add risks and controls one at a time with Add.

2. Risks

For each risk, fill in What could go wrong?, a description, Your reference, Category, Owner and How are you responding?:

• Mitigate — put controls in place
• Accept — live with it, on the record
• Transfer — insure or contract it out
• Avoid — stop doing the thing

Score Likelihood (Rare to Almost certain) and Impact (Negligible to Severe) twice: before controls and after controls. Set Review again on if you promise to review it; leave it empty and it is never overdue.

Then use Link a control to say which controls treat the risk. When you have reviewed a risk, choose Mark as reviewed.

On plans with AI actions, Suggest scores and controls with AI… on a risk proposes scores and controls for you to accept or change.

Accepting a risk

Choose Accept this risk…, say Why is it accepted? and Accepted until, and click Sign the acceptance. Only a company admin can accept a risk. The page shows who accepted it and until when.

3. Controls

For each control, fill in What is the control? and How does it work?, then:

• When does it act? Preventive (stops it happening), Detective (notices it happened) or Corrective (puts it right afterwards).
• Who performs it? Manual, automated or hybrid.
• How often it should operate, and its Owner.
• Catalogue and Clause: the framework it meets (Our own, ISO 27001, SOC 2, PCI DSS, POPIA or GDPR). Does it apply to you? and Why does it apply, or why not? feed your Statement of Applicability.

4. Link a control to the work

Choose Link to what it governs and pick what the control is about. You can link a process, a step, an action type, a schedule, a bot, a queue, a form, a credential, an application, an environment, a role or a team.

• Linked to a process or a step, every run becomes evidence the control operated.
• Linked to anything, the page shows what is true about it now.
• A choice marked ⚠ would count runs this control already counts, twice.

5. Scheduled checks

On a link, choose a check for the platform to run for you, such as "Ran within the last … days", "At least …% of runs completed" or "No run failed". Under Number to check against (optional) you can change the number.

The check runs on the control's own schedule, following How often, and keeps each pass or fail as evidence. It runs once straight away so you can see the answer; that first answer is not kept as evidence.

6. Sign-offs for manual controls

A manual control cannot prove itself from run history. After you perform it, choose Record a sign-off:

1. Under What happened, pick It operated as intended, It did not operate — this is an exception or It was skipped this time.
2. Say What did you check?
3. Attach the proof an auditor will ask for (PDF, image, Word, Excel, CSV or text, 10 MB at most).
4. Click Record.

The sign-off is kept under your name and is not removed on any schedule.

7. Training as evidence

If staff must pass a quiz, link the control to that form and pick a check such as "Nobody is overdue", "At least …% of people up to date" or "At least …% of attempts passed". Who is up to date, due or overdue is on the form's Training tab. See Quizzes and training.

8. Reminders

Once a day, the owner gets a task in My Tasks when:

• a risk's review is coming up or late;
• a manual or hybrid control has had no sign-off within its frequency;
• a signed risk acceptance is about to run out, or has.

The task closes by itself when the review or sign-off is recorded. With no owner, the task goes to the unassigned pool.

9. What needs attention

Each control shows a status: Operating, Has exceptions, Never observed, Not linked, Draft, Excluded or Retired. Risks and controls also warn about problems such as "Nothing is treating this risk", "Review overdue", "Nobody owns this control" or "Nobody has signed this off". When a control that treats a risk stops working, the risk is flagged too, because its after-controls score is no longer backed.

10. Reports for an auditor or a board

On Register overview:

• Board report downloads a PDF.
• Export the register (.xlsx) downloads both sheets in the import format, so you can edit and upload them again.
• Statement of Applicability, ISO 27001 (.xlsx) lists every clause, whether it applies, why not, and the controls that cover it. Criteria coverage, SOC 2 (.xlsx) does the same for SOC 2.