Appearance
Control Register
Where to find it: Controls & Assurance, then Control Register (/controls).
The Control Register is the authoritative record of what your organisation does to manage risk and meet obligations. Everything in the assurance domain hangs off it.
What a control is
A control is a described, owned mechanism that reduces risk or discharges an obligation. In OrviQ a control record carries:
| Field | Purpose |
|---|---|
| Reference | The control's human-facing identifier |
| Name | A short, recognisable title |
| Description | What the control does, in operational terms |
| Owner | The accountable person |
| Category and business domain | Classification for filtering and reporting |
| Control function | Preventive, detective, corrective and similar classifications |
| Nature and implementation type | Manual, automated, hybrid |
| Automation | Degree of automation |
| Frequency | How often the control operates |
| Status | Where the control is in its lifecycle |
| Approval status | Governance state of the control record |
| Source document | Where the control text came from, if extracted |
| Folder | Organisational grouping |
Control origin
Not every control in the register is yours. Origin classification keeps the distinction visible:
| Origin | Meaning |
|---|---|
organization | A native internal control authored by your organisation |
reference_external | Ingested from a standards body |
reference_curated | A pre-packaged industry baseline |
reference_scf | Derived from a common controls framework catalogue |
This matters when reading a crosswalk. A mapping between a reference control and an obligation is a catalogue fact. A mapping between one of your own controls and an obligation is a statement about your organisation. Origin lets you tell them apart at a glance.
Getting controls into the register
| Route | Description |
|---|---|
| Manual authoring | Create a control directly. Requires control.create. |
| Control source ingestion | Upload a policy, procedure or standard; extraction proposes candidate controls for review and publication. See Control Sources. |
| Catalogue reference | Bring in reference controls from an external or curated catalogue. |
Lifecycle
A control record moves through creation, review, approval and eventual retirement. The register distinguishes the control's operational status from its approval status — a control can be operationally active while a proposed change to its description is still awaiting approval.
Changing a control that other records depend on is a governed act: crosswalk mappings, indicators, assessments and evidence links all reference it.
Retiring a control does not retire what it supported
Retiring a control leaves any approved mappings pointing at it. Retire the mappings deliberately so requirement assurance reflects that the control no longer addresses the obligation. See Crosswalk Lifecycle.
What connects to a control
Common tasks
Create a control
- Open the Control Register and select Add control.
- Give it a clear name and an operational description. Write what someone actually does, not what the policy aspires to.
- Set the owner, category, function, nature and frequency.
- Save. Requires
control.create.
Map a control to an obligation
Use the Control Crosswalk. Requires mapping.propose; approval requires mapping.review and cannot be done by the proposer.
Assess a control
Use Control Assessment for design assessment, operating effectiveness and testing. Requires control.assess or assessment.submit.
Attach an indicator
Define a deterministic rule that evaluates evidence assertions for the control. See Indicators. Requires indicator.manage and the Continuous Assurance entitlement.
Find controls with no mapping
Filter the register for unmapped controls. Controls that address nothing are either genuinely discretionary or a sign of an incomplete crosswalk.
Writing good control descriptions
The description is what a reviewer, an auditor and an AI mapping suggestion all read. Vague descriptions produce vague mappings and unfalsifiable assessments.
| Weak | Better |
|---|---|
| "Access is managed appropriately." | "Privileged access to production systems is granted only through a documented request approved by the system owner, is time-bound to 90 days, and is revoked automatically on expiry or on termination processed in the HR system." |
| "Backups are performed." | "Full backups of in-scope databases run nightly to a separate region; restore is tested quarterly against a sample of three databases selected at random." |
The better versions are longer because they name the trigger, the actor, the frequency and the outcome — which is exactly what an indicator needs in order to test them.
Permissions
| Action | Permission |
|---|---|
| View the register | control.read |
| Create controls | control.create |
| Edit controls | control.update |
| Run control evaluations | control.assess |
| Approve control changes | control.approve |
| Build the control discovery index | control.index |
All require the control_assurance entitlement.
Example
A bank's register holds 412 controls:
| Origin | Count | Use |
|---|---|---|
organization | 287 | The bank's own controls, mapped to obligations across five frameworks |
reference_external | 93 | Standards body control set, retained for crosswalk reference |
reference_curated | 32 | Curated baseline used during a gap assessment |
Of the 287 organisational controls, 244 carry at least one approved mapping. The remaining 43 are reviewed quarterly: some are genuinely discretionary risk controls with no regulatory driver, and some turn out to be unmapped because nobody proposed the mapping — which the review is designed to surface.
Troubleshooting
"A control shows no effectiveness." Effectiveness requires indicators. A control with no active indicator reports not_assessed, which is correct. See Control Effectiveness.
"I cannot edit a control." You need control.update. Some changes additionally require approval through control.approve.
"Two controls describe the same thing." Common after ingesting several policy documents. Consolidate deliberately: repoint mappings to the surviving control before retiring the duplicate, or the obligations it addressed will silently lose their mapping.
"The Control Register is not visible." Requires the control_assurance entitlement and control.read.