Independent UK governance, risk & complianceOur editorial standards ↗Practical guidance. Accountable decisions.
GRC.ME.UKDisclaimer

Risk working document

Control design & testing record

Distinguish a documented control from one that operates effectively.

Version 1.0 · 1 November 2026Editorial template · adapt to your scope
Working notes stay in this page until you explicitly save or export them. Record evidence references rather than confidential or sensitive source documents. A template does not confirm compliance.

Complete each relevant field and record reasons for exclusions. Keep statutory deadlines separate from internal project targets.

State the risk or requirement addressed.
Owner, frequency, input, action and expected output.
Use references, dates and permitted access; avoid confidential uploads.
Define method, population, selection, period and limitations.
Record facts, failures, missing evidence and assessment criteria.
Specify the improvement, accountable owner and target.
Record independent challenge where appropriate; a claimed fix is not a passed retest.

GRC.me.uk · Source-linked guidance at the guidance library · Read the disclaimer.