Controls
Risk Management → Controls Library, and the Control Assessment step of any risk assessment.
The library holds what the organisation does about its risks. An assessment maps controls from that library to one risk and rates how well each is working; the residual score falls out of those ratings.
The library
A control is a description of something the organisation does — a standard, a procedure, a check, a system setting — written once and mapped to as many risks as it bears on. Each carries:
| Field | Why it matters |
|---|---|
| Name and code | The code is how the same control is recognised across engagements and years. |
| Type | Preventive, detective, corrective or directive. |
| Category | Groups the library for browsing. |
| Description | What the control actually is. This is what the next assessor reads. |
| Implementation guidance | How it is meant to be run. |
| Testing procedure | How an assessor establishes whether it is working. |
Write the description for the person who will map it in two years and has never seen it before. A library of one-line titles is a list, not a library.
Mapping a control during an assessment
In the assessment's Control Assessment step, Map Control opens the picker. For each control you map, record:
- Implementation status — implemented, partial, not implemented, or not applicable
- Operational effectiveness — from not assessed through to highly effective
How the two fields combine
Both matter. What a control contributes is its effectiveness rating, limited by whether the control is actually in place:
| Implementation status | What it contributes |
|---|---|
| Implemented | The full rating |
| Partially implemented | Capped at 30%, however it is rated |
| Not implemented | Nothing |
| Not applicable | Nothing |
A control marked Not implemented and rated Highly effective reduces the risk by nothing, and the card says so. That pairing describes a control you intend to have, not one that is protecting you, and the residual score is a statement about today.
A control that is implemented but rated ineffective also reduces nothing — which is the correct answer and often the uncomfortable one.
What each rating is worth
| Operational effectiveness | Value |
|---|---|
| Highly effective | 95% |
| Effective | 70% |
| Partially effective | 30% |
| Ineffective | 0% |
| Not assessed | 0% |
Not assessed and ineffective both count as nothing. That is the safe direction, but they are different statements — one says the control does not work, the other says nobody has looked. If a risk's residual rests on controls nobody has assessed, the number is not telling you what it appears to.
How several controls combine
Controls compound multiplicatively, not additively. Each one works on whatever likelihood the ones before it left behind:
aggregate = 1 − (1 − e₁) × (1 − e₂) × … × (1 − eₙ)
Controls reduce likelihood, not impact
This is the part that decides what the residual score means.
Impact does not move. Impact is what happens if the event occurs. A permit-to-work system, a scaffolding standard and a site induction make a fall from height less likely; none of them makes the fall less fatal. Whatever impact the assessor recorded is the impact the residual carries.
Likelihood takes the whole reduction:
residual likelihood = assessed likelihood × (1 − aggregate) [floored at 1]
residual score = residual likelihood × impact
Worked through, for a risk assessed at likelihood 3 × impact 5 = 15 with an effective control (70%) and a partially effective one (30%):
aggregate = 1 − (1 − 0.70) × (1 − 0.30)
= 1 − 0.21
= 0.79 → 79%
likelihood = 3 × (1 − 0.79) = 0.63 → floored to 1
residual = 1 × 5
= 5
The second control is worth a fraction of the first, because it only gets the likelihood the first one left behind. Order makes no difference.
A risk assessed with an impact of 5 can never be controlled below 5, however many controls are mapped and however effective they are. That is deliberate. Controls make an event less likely; they do not make it impossible, and they do not make it less severe. A register that shows a fatality risk at 0.1 is not telling you that you are safe — it is telling you the arithmetic has left the building.
What happens as you add more
For a risk at likelihood 5 × impact 4 = 20, adding effective (70%) controls:
| Controls mapped | Aggregate | Residual likelihood | Residual |
|---|---|---|---|
| 1 × 70% | 70% | 1.5 | 6.0 |
| + 1 × 30% | 79% | 1.05 | 4.2 |
| + 1 × 70% | 94% | floored to 1 | 4.0 |
| + 1 × 70% | 98% | floored to 1 | 4.0 |
Past the floor, mapping further controls stops moving the number. That is the honest answer: you are no longer making the event less likely in any way a 1–5 scale can express, and a score that kept falling would be describing your paperwork rather than your site.
They often do not. Four controls that all depend on the same supervision, the same contractor or the same safety culture degrade together, and the formula cannot see that. Treat a residual sitting on its floor as a prompt to look at whether the controls are genuinely independent, not as a result.
Changing a control's effectiveness or implementation status recalculates the residual score and the residual likelihood, and writes them back to the risk register through the same audited path an assessment uses. Residual impact is written too — as the assessed impact, unchanged. It is not a scratch pad.
When the control you need is not there
Two ways forward, both from inside the assessment.
New control adds it to the library and selects it, without losing the assessment you are part way through. Give it a name, a code and a description; you can fill in the guidance and testing procedure later from the library page.
The control is added to your organisation's library, so the next assessor mapping a similar risk will find it. That is the point — a control created here is not a one-off note attached to this assessment.
Suggest asks for controls from your library that bear on this risk.
Suggested controls
Available only when your organisation has switched risk AI assistance on in Settings → AI assistance, and a model is configured. It is off by default.
What it does: sends the risk's title, description, threat source and vulnerability, along with the names and descriptions of the controls in your library, and returns a ranked list of the ones that appear to apply — each with a relevance (primary, supporting or partial), a confidence, and one sentence saying why.
What it does not do:
- It cannot invent a control. Every suggestion is checked against the library before you see it, and anything that is not in there is dropped. If nothing in the library fits, it says so rather than describing a control you do not have.
- It does not map anything. Selecting a suggestion puts it in the picker; you still set the implementation status and effectiveness yourself, and nothing reaches the register until you do.
- It does not read your evidence. Control names and descriptions from the library, and the risk's own text. Nothing else.
Treat it as a reading of your library, not a judgement about your risk. It has no idea whether the control is actually working here — that is the assessment, and that is still yours.
Permissions
| Action | Minimum role |
|---|---|
| Browse the library, view mapped controls | Viewer |
| Create a control, map one, rate effectiveness | Analyst |
| Request suggestions | Manager |