Enterprise Controls Framework for the Audit and Risk domain — the optimised set of process controls that give effect to its technical controls.
9 process controls, grouped by sub-policy and shown in full six-level lineage with operational artifacts.
CAO-200 Audit and Risk
CAO-210 Risk Management Policy
CAO-200 Audit and Risk › CAO-210 Risk Management Policy › CAO-211 Risk Governance and Appetite › CAO-2111 Establish a risk management framework › CAO-21111 Risk management framework established and integrated into governance and operations.
CAO-211111 · Examine the risk management framework to confirm it is established and integrated.
Method: Examine · Expected evidence: Risk management framework
Operational controls: CAO-2111111 Risk Management Framework — template
CAO-200 Audit and Risk › CAO-210 Risk Management Policy › CAO-211 Risk Governance and Appetite › CAO-2112 Define risk appetite and tolerance › CAO-21121 Risk appetite and tolerance defined and approved by the governing body.
CAO-211211 · Examine risk appetite statements to confirm they are defined and approved.
Method: Examine · Expected evidence: Risk appetite statement
Operational controls: CAO-2112111 Risk Appetite Statement — template
CAO-200 Audit and Risk › CAO-210 Risk Management Policy › CAO-212 Risk Identification and Assessment › CAO-2121 Identify risks across the organisation › CAO-21211 Risks identified systematically across the organisation.
CAO-212111 · Examine the risk register to confirm risks are identified across the organisation.
Method: Examine · Expected evidence: Risk register
Operational controls: CAO-2121111 Risk Register
CAO-200 Audit and Risk › CAO-210 Risk Management Policy › CAO-212 Risk Identification and Assessment › CAO-2122 Analyse and evaluate risks › CAO-21221 Risks analysed and evaluated against criteria to prioritise treatment.
CAO-212211 · Examine risk assessments to confirm risks are analysed and evaluated.
Method: Examine · Expected evidence: Risk assessment records
Operational controls: CAO-2122111 Risk Assessment Template
CAO-200 Audit and Risk › CAO-210 Risk Management Policy › CAO-213 Risk Treatment › CAO-2131 Treat and mitigate risks › CAO-21311 Risks treated through selected options, with treatment plans implemented and tracked.
CAO-213111 · Examine risk treatment plans to confirm risks are treated and tracked.
Method: Examine · Expected evidence: Risk treatment plan
Operational controls: CAO-2131111 Risk Treatment Plan
CAO-200 Audit and Risk › CAO-210 Risk Management Policy › CAO-214 Risk Monitoring and Reporting › CAO-2141 Monitor and report on risk › CAO-21411 Risks monitored and reported to the governing body and stakeholders.
CAO-214111 · Examine risk monitoring and reporting to confirm risks are tracked and reported.
Method: Examine · Expected evidence: Risk reports
Operational controls: CAO-2141111 Risk Reporting Register
CAO-220 Audit and Assurance Policy
CAO-200 Audit and Risk › CAO-220 Audit and Assurance Policy › CAO-221 Audit Oversight › CAO-2211 Oversee audit, assurance and internal control › CAO-22111 Audit, assurance and internal control overseen by an independent audit function.
CAO-221111 · Examine audit oversight arrangements to confirm independent oversight of assurance and controls.
Method: Examine · Expected evidence: Audit committee and assurance records
Operational controls: CAO-2211111 Internal Audit Charter — template
CAO-200 Audit and Risk › CAO-220 Audit and Assurance Policy › CAO-221 Audit Oversight › CAO-2212 Operate a combined assurance model across management, functions and assurance providers › CAO-22121 Combined assurance model developed, designed for coverage and coordinated across assurance providers.
CAO-221211 · Examine the combined assurance model for coverage, coordination and effectiveness.
Method: examine · Expected evidence: combined assurance model; assurance coverage map; audit committee minutes
Operational controls: CAO-2212111 Combined Assurance Model — template
CAO-200 Audit and Risk › CAO-220 Audit and Assurance Policy › CAO-222 Conformance and Independent Review › CAO-2221 Assure conformance and independent review › CAO-22211 Conformance assured through independent review and audit programmes.
CAO-222111 · Examine independent review and audit results to confirm conformance is assured.
Method: Examine · Expected evidence: Independent review and audit reports
Operational controls: CAO-2221111 Audit Programme Register