GRC & Risk
Continuous Control Monitoring: From Annual Audits to Real-Time Assurance
Point-in-time audits tell you a control worked on the day it was tested. Continuous control monitoring tells you whether it is working now.
Key takeaways
- Write risks as cause–event–consequence statements.
- Use one scoring method across the organization, with defined scales.
- Link each risk to controls, owners, treatment plans and KRIs.
- Report risks against appetite, not as long lists.
The problem with most risk registers
Common failings include entries like "cyber attack" with no context, scores that differ by department, risks without owners and treatment plans that never close. The register becomes a compliance artefact rather than a management tool.
Writing a good risk statement
Use the structure cause → event → consequence. For example: "Because privileged accounts are not centrally controlled, an attacker could gain domain administrator access, leading to a ransomware outage of core services for several days." This makes the risk understandable, measurable and treatable.
Consistent scoring
| Element | Guidance |
|---|---|
| Likelihood | Five-point scale with defined frequencies |
| Impact | Five-point scale across financial, operational, regulatory, reputational and safety dimensions |
| Inherent risk | Before controls |
| Residual risk | After existing controls, based on tested effectiveness |
| Target risk | After planned treatment |
ISO 31000 provides the principles; your methodology defines the scales. Where data allows, quantitative methods express cyber risk in financial terms for prioritisation.
Appetite and tolerance
The board sets risk appetite statements by category. Each risk is compared against them: risks above appetite need treatment plans with dates and budget, or formal acceptance by an appropriate executive.
Treatment options
- Mitigate — add or strengthen controls.
- Transfer — insurance or contractual transfer.
- Avoid — stop the activity.
- Accept — documented, time-limited and approved at the right level.
Keeping it alive
Review high risks monthly and the full register quarterly. Connect key risk indicators so that a deteriorating metric automatically prompts reassessment. Link incidents and audit findings back to the risks they relate to.
Reporting to the board
Show a heat map of top risks against appetite, movements since the last report, overdue treatments and emerging risks. Keep it to a few pages. The same data can feed regulator and auditor reporting from a single source of truth.
Next step: NAZZTEC AI GRC includes an insurance-grade risk register with KRIs and appetite tracking. Talk to our GRC team.
Frequently asked questions
How many risks should a register contain?
Enough to reflect reality without noise — typically 30 to 80 enterprise-level risks, with detailed operational risks held at department level.
Should cyber risk sit in the enterprise register?
Yes. Top cyber risks should be visible at board level alongside financial, operational and strategic risks.
What is a key risk indicator?
A metric that signals a change in risk exposure, such as the number of critical vulnerabilities overdue for remediation.
NAZZTEC Editorial TeamWritten and reviewed by NAZZTEC practitioners. This briefing is general guidance, not legal advice.
