Identify the control questions for review.

Choose the highest consequence a control failure could reasonably affect.

Select oneLimited – Internal process impact with contained consequencesMaterial – Customer, vendor, financial, or operational consequencesHigh – Regulated, federal, public-trust, or significant financial consequences

Describe whether one authorized role owns the control decision and documented closure.

Select oneDefined – Named owner, authority, escalation, and closure evidencePartial – Ownership exists but authority or closure is fragmentedUnclear – No single accountable owner or decision path

Consider documented assessment coverage, update triggers, material schemes, and remediation tracking.

Select oneCurrent – Documented, risk-based, and updated for material changePartial – Periodic assessment exists but coverage or triggers are incompleteLimited – Assessment is outdated, informal, unknown, or absent

Consider initiation, approval, segregation, vendor or account changes, trusted-channel confirmation, and exceptions.

Select oneControlled – Independent approval, protected changes, and retained evidenceMixed – Core controls exist but exceptions or change paths are inconsistentLimited – Approval, segregation, confirmation, or change controls are weak or unclear

Consider identity proofing, authentication, onboarding, beneficial or authorized-party review, and exception handling.

Select oneLayered – Risk-based safeguards, exception control, and retained evidencePartial – Controls exist but coverage or exception governance is inconsistentLimited – Safeguards, escalation, or evidence are minimal or unclear

Consider risk-based rules, alert tuning, capacity, queue age, quality review, and coverage of material channels.

Select oneCurrent – Risk-based coverage is tuned, reviewed, and supported by capacityPartial – Coverage exists but tuning, capacity, or channel visibility is unevenLimited – Monitoring coverage, ownership, or review capacity is weak or unknown

Consider triage, escalation, investigation boundaries, decision authority, recovery, reporting, and closure.

Select oneDefined – Documented triage, authority, escalation, response, and closurePartial – Process exists but handoffs, authority, or closure are inconsistentUnclear – Response is ad hoc, untested, fragmented, or unknown

Consider source support, approvals, case records, exceptions, model or rule changes, remediation evidence, and retention.

Select oneTraceable – Decisions, changes, exceptions, and closure evidence are retainedIncomplete – Key records exist but chronology, approvals, or closure evidence has gapsLimited – Material decisions or changes cannot be reliably reconstructed

Use categories only. Do not enter allegations, identities, account details, or transaction records.

Select oneStable – No material unresolved change or recurring signal identifiedIncreasing – Volume, products, vendors, disputes, alerts, or exceptions are risingRepeated – Material issues, unresolved exceptions, or control failures are recurring