Control Assurance

Overview

Control Assurance in Risk Legion provides a framework for evaluating the design and operational effectiveness of controls that mitigate business risks. The framework uses a dual assessment approach: Test of Design (ToD) and Test of Effectiveness (ToE).

Control Hierarchy

Risk Legion organizes controls in a two-level hierarchy:

Key Control (Parent)
├── Sub-Control 1
├── Sub-Control 2
└── Sub-Control 3

Key Controls

Key Controls are high-level control categories that represent major control themes:

Preventive Controls - Stop risks from occurring
Detective Controls - Identify risks that have occurred
Corrective Controls - Remediate identified issues

Examples:

Automated Credit Scoring and Risk Rating
Multi-Factor Authentication (MFA)
Real-Time AML Transaction Monitoring
Asset-Liability Committee (ALCO)

Sub-Controls

Sub-Controls are specific control instances under each Key Control:

Represent individual control activities
Have their own ToD and ToE assessments
Link directly to risk scenarios in BRAs

Examples under “Multi-Factor Authentication (MFA)”:

Biometric Authentication Enrollment
Failed Authentication Lockout
Session Timeout Policy

Test of Design (ToD)

Test of Design evaluates how well a control is designed to mitigate the identified risk.

ToD Rating Scale

Grade	Rating	Description
A	Excellent	Control design is comprehensive, automated, and addresses all aspects of the risk
B	Good	Control design is well-structured with minor gaps that don’t significantly impact effectiveness
C	Adequate	Control design meets minimum requirements but has noticeable gaps
D	Weak	Control design has significant gaps that may allow risk to materialize
E	Inadequate	Control design is fundamentally flawed or non-existent

ToD Assessment Criteria

When assessing ToD, consider:

Documentation

Are control procedures documented?

Policy documents exist
Procedures are current
Responsibilities are clear

Coverage

Does the control address the full risk?

All risk scenarios covered
No significant gaps
Edge cases considered

Automation

Is the control automated where appropriate?

Manual vs. automated balance
Consistent execution
Scalable design

Integration

Does the control fit the process?

Integrated into workflows
Not easily bypassed
Sustainable long-term

Test of Effectiveness (ToE)

Test of Effectiveness evaluates how well the control operates in practice.

ToE Rating Scale

Grade	Rating	Description
1	Highly Effective	Control operates consistently and catches/prevents 95%+ of relevant issues
2	Effective	Control operates reliably with occasional minor exceptions (85-95%)
3	Moderately Effective	Control operates adequately but with regular exceptions (70-85%)
4	Less Effective	Control has significant operational gaps (50-70%)
5	Ineffective	Control fails to operate as designed (<50%)

ToE Assessment Methods

Method	Description	When to Use
Sample Testing	Test a sample of transactions/activities	High-volume automated controls
Walkthrough	Observe control in operation	Manual controls, processes
Inquiry	Interview control operators	Understanding procedures
Inspection	Review documentation/evidence	Periodic reviews, approvals
Re-performance	Re-execute the control	Critical calculations

Total Effectiveness Calculation

Risk Legion automatically calculates Total Effectiveness from the ToD and ToE ratings:

Total Effectiveness = f(ToD, ToE)

Effectiveness Matrix

	ToE 1	ToE 2	ToE 3	ToE 4	ToE 5
ToD A	Highly Effective	Highly Effective	Effective	Moderately Effective	Less Effective
ToD B	Highly Effective	Effective	Effective	Moderately Effective	Less Effective
ToD C	Effective	Effective	Moderately Effective	Less Effective	Not Effective
ToD D	Moderately Effective	Moderately Effective	Less Effective	Not Effective	Not Effective
ToD E	Less Effective	Less Effective	Not Effective	Not Effective	Not Effective

The matrix uses a conservative approach: both design AND effectiveness must be strong for a control to be rated highly effective.

Control Assurance Workflow

Step 1: Identify Controls

During BRA creation, controls are linked to risk scenarios:

System suggests controls from the Risk Library
Assessor reviews and confirms relevant controls
Additional controls can be added as needed

Step 2: Assess Test of Design

For each sub-control:

Review control documentation
Evaluate design against risk
Assign ToD rating (A-E)
Provide justification

{
  "sub_control_id": "sc-001",
  "tod": "B",
  "tod_justification": "MFA design is comprehensive with biometric and OTP options. Minor gap: legacy systems not yet integrated."
}

Step 3: Assess Test of Effectiveness

For each sub-control:

Select testing method
Execute testing procedure
Document testing date and tester
Assign ToE rating (1-5)
Provide justification and evidence notes

{
  "sub_control_id": "sc-001",
  "toe": "2",
  "toe_justification": "Sample testing of 100 transactions showed 93% MFA compliance. 7% exceptions were authorized by security team.",
  "testing_date": "2026-01-15",
  "tested_by": "Jane Smith",
  "evidence_notes": "Sample report attached, exception log reviewed"
}

Step 4: Review and Update

Controls should be reassessed:

At each BRA assessment period
After significant control changes
Following control failures or incidents
When new risks are identified

Control Heat Map

The Control Heat Map visualizes control effectiveness across your organization:

Dashboard View

The dashboard displays:

ToD vs ToE Matrix - Distribution of controls by ratings
Effectiveness Summary - Counts by effectiveness level
Trend Indicators - Changes from previous period

Interpreting the Heat Map

Identify Clusters

Look for concentrations of controls in specific cells

Assess Risk Areas

Controls in bottom-right (D/E + 4/5) need immediate attention

Track Improvements

Monitor movement toward top-left over time

Plan Remediation

Prioritize controls with high residual risk scenarios

Key Control Effectiveness Aggregation

Key Control effectiveness is aggregated from its Sub-Controls using a worst-case approach:

def aggregate_key_control_effectiveness(sub_controls):
    # If any sub-control is "Not Effective", key control is "Not Effective"
    if any(sc.total_effectiveness == "Not Effective" for sc in sub_controls):
        return "Not Effective"
    
    # If any sub-control is "Less Effective", key control is "Less Effective"
    if any(sc.total_effectiveness == "Less Effective" for sc in sub_controls):
        return "Less Effective"
    
    # Continue up the scale...

This conservative approach ensures that weaknesses in individual sub-controls are not masked by stronger controls.

Control Library Management

Adding Controls

Client Admins can add custom controls:

Navigate to Governance → Risk Library → Key Controls
Click Add Key Control
Enter control details (name, category, description)
Add Sub-Controls under the Key Control

Linking Controls to Scenarios

Controls can be linked to risk scenarios:

Navigate to Governance → Risk Library → Risk Scenarios
Select a scenario
Click Link Controls
Select relevant Key Controls and Sub-Controls

Archiving Controls

Controls can be archived (soft delete):

Click the archive icon on the control
Confirm archiving
Archived controls remain in historical BRAs
Can be restored if needed

Best Practices

Consistent Rating Criteria

Develop rating guidelines for your organization
Train assessors on consistent application
Use calibration sessions for alignment

Evidence-Based Assessments

Document testing procedures
Retain evidence of testing
Reference specific findings in justifications

Regular Updates

Reassess controls at least annually
Update after significant changes
Track trends over time

Remediation Tracking

Create action plans for weak controls
Set improvement targets
Monitor remediation progress

API Reference

Endpoint	Method	Description
`/api/v1/controls/key-controls`	GET	List key controls
`/api/v1/controls/key-controls`	POST	Create key control
`/api/v1/controls/sub-controls`	GET	List sub-controls
`/api/v1/controls/sub-controls`	POST	Create sub-control
`/api/v1/controls/sub-controls/{id}`	PATCH	Update sub-control (ToD/ToE)
`/api/v1/controls/effectiveness`	GET	Get effectiveness summary
`/api/v1/controls/heat-map`	GET	Get heat map data

See API Reference for complete documentation.

Getting Started

Core Concepts

Testing

User Roles

Architecture

Overview

Control Hierarchy

Key Controls

Sub-Controls

Test of Design (ToD)

ToD Rating Scale

ToD Assessment Criteria

Documentation

Coverage

Automation

Integration

Test of Effectiveness (ToE)

ToE Rating Scale

ToE Assessment Methods

Total Effectiveness Calculation

Effectiveness Matrix

Control Assurance Workflow

Step 1: Identify Controls

Step 2: Assess Test of Design

Step 3: Assess Test of Effectiveness

Step 4: Review and Update

Control Heat Map

Dashboard View

Interpreting the Heat Map

Key Control Effectiveness Aggregation

Control Library Management

Adding Controls

Linking Controls to Scenarios

Archiving Controls

Best Practices

API Reference

​Overview

​Control Hierarchy

​Key Controls

​Sub-Controls

​Test of Design (ToD)

​ToD Rating Scale

​ToD Assessment Criteria

Documentation

Coverage

Automation

Integration

​Test of Effectiveness (ToE)

​ToE Rating Scale

​ToE Assessment Methods

​Total Effectiveness Calculation

​Effectiveness Matrix

​Control Assurance Workflow

​Step 1: Identify Controls

​Step 2: Assess Test of Design

​Step 3: Assess Test of Effectiveness

​Step 4: Review and Update

​Control Heat Map

​Dashboard View

​Interpreting the Heat Map

​Key Control Effectiveness Aggregation

​Control Library Management

​Adding Controls

​Linking Controls to Scenarios

​Archiving Controls

​Best Practices

​API Reference

Overview

Control Hierarchy

Key Controls

Sub-Controls

Test of Design (ToD)

ToD Rating Scale

ToD Assessment Criteria

Test of Effectiveness (ToE)

ToE Rating Scale

ToE Assessment Methods

Total Effectiveness Calculation

Effectiveness Matrix

Control Assurance Workflow

Step 1: Identify Controls

Step 2: Assess Test of Design

Step 3: Assess Test of Effectiveness

Step 4: Review and Update

Control Heat Map

Dashboard View

Interpreting the Heat Map

Key Control Effectiveness Aggregation

Control Library Management

Adding Controls

Linking Controls to Scenarios

Archiving Controls

Best Practices

API Reference