{"text_format":"1","workbook":"xlsx","n_sheets":4,"sheets":["instructions","controls","risk analysis 1","risk analysis 2"],"not_rendered":{"charts":0,"images":0,"macros":1,"external_links":0,"defined_names":0,"comments":3,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"instructions","index":0,"n_rows":45,"n_cols":2,"rows_kept":45,"cut":false,"hidden":false,"merged":[]}
[]
[null,"General risk control matrix"]
[]
[null,"For a good introduction to this kind of risk-control matrix refer to the web page \"Matrix Mapping: the easiest and best way to map internal controls\" at www.workinginuncertainty.co.uk/matrices.shtml"]
[]
[null,"The main advantage of this style is that it allows you to cope, easily, with the common situation of having a many:many relation between risks and controls."]
[]
[null,"This template has two features not described in that article."]
[]
[null,"First, in this template there are three distinct groups of controls: those already in place, those agreed but not yet operating (i.e. in development), and those proposed but not yet agreed on."]
[]
[null,"After each set of controls there are revised summaries of the level of control provided."]
[]
[null,"Second, there is space for two risk analyses.  There's no need to do two, but if alternative perspectives could be useful there's no reason for not using both together and mapping controls to both of them."]
[]
[null,"Furthermore, if you want to migrate from one risk analyis to another, having the ability to show two during a changeover period might be very useful."]
[]
[]
[null,"Several columns are provided for capturing information about controls and you can use, ignore, or add to them as you wish."]
[]
[null,"One special feature of this design is that macros (on the buttons) bring the risks used as headings in the Controls sheet into line with the risks in the risk analysis sheets."]
[]
[null,"This is done by working from the risk analysis to the controls matrix, preserving control mapping information only where the risk reference in the risk analysis matches a risk reference in the control matrix."]
[]
[null,"Whenever you change a risk analysis use the appropriate button at the end to bring the two back into agreement."]
[]
[null,"Take care not to type over the formulae that link risk sizes between the control matrix and the risk analyses. The rating of risk with all controls failed ('inherent risk' if you prefer) is typed into the risk analysis, but all the other assessments are typed into the control matrix (where you can see the controls)."]
[]
[null,"You need to decide what single metric of risk 'size' you will use and update the headings to make clear what your choice is.  I've just used the word 'size' as a place holder."]
[]
[null,"When you add extra page headings and decoration please make sure you don't insert any rows above the headings on any page, or insert columns into the risk analysis pages.  If you do, this will confuse the macro.  To sort it out you could change the relevant constants in the macro code, which are explained at the start of module 1.  If you don't know what I'm talking about, it's best to avoid inserting rows or columns that will move any heading!"]
[]
[]
[null,"Please feel free to contact me with any queries or suggestions at matthew@workinginuncertainty.co.uk"]
[]
[]
[null,"Important note"]
[]
[null,"Risk management is much more than listing risks and mapping them to controls. This tool is just a small part of your total approach and should only be used where appropriate."]
[]
[null,"Typically, that means it should be used to check the coverage of 'controls' or rather to think about the performance of a process design against potential challenges or regulations."]
[]
[null,"Risk control mapping is best applied where the 'risks' are small and not connected to each other. If 'risks' tend to trigger each other then it is wrong to pretend that they are separate things and this mistake will cause you to underestimate your risk systematically."]
[]
[null,"To make a real difference to management of risk you should focus on making incremental improvements to the way core management activities are done so that their performance under uncertainty is improved."]

{"sheet":"controls","index":1,"n_rows":97,"n_cols":31,"rows_kept":97,"cut":false,"hidden":false,"merged":[]}
[]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Risk ref","r1.1","r1.2","r1.3","r1.4","r1.5",null,null,null,null,"Risk ref","r2.1","r2.2","r2.3","r2.4","r2.5"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,"ra1","Short name","r1","r2","r3","r4","r5",null,null,null,"ra2","Short name","r1","r2","r3","r4","r5"]
["Sort","Control group","Control","Control ID","Ref to detail","Owner - operational","Owner - development","Frequency","Sampling","To do date","Performance evidence","Perform-ance rating","Operation cost","Development cost","risk analysis 1","Size",{"$f":"'risk analysis 1'!$G$6","v":10},{"$f":"'risk analysis 1'!$G$7","v":20},{"$f":"'risk analysis 1'!$G$8","v":30},{"$f":"'risk analysis 1'!$G$9","v":40},{"$f":"'risk analysis 1'!$G$10","v":50},null,null,null,"risk analysis 2","Size",{"$f":"'risk analysis 2'!$G$6","v":10},{"$f":"'risk analysis 2'!$G$7","v":100},{"$f":"'risk analysis 2'!$G$8","v":10},{"$f":"'risk analysis 2'!$G$9","v":100},{"$f":"'risk analysis 2'!$G$10","v":10}]
[]
[null,"CONTROLS CURRENTLY IN PLACE"]
[1,"Monitoring","Business monitoring report: debtors","m1"]
[2,"Monitoring","Process monitoring report: process stats","m2"]
["etc","etc","etc"]
[]
[]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Size after existing controls",10,20,30,40,50,null,null,null,null,"Estimate of remaining risk",10,20,30,40,50]
[]
[]
[null,"CONTROLS IN DEVELOPMENT"]
[1,"Monitoring","Business monitoring report: debtors","m1"]
[2,"Monitoring","Process monitoring report: process stats","m2"]
["etc","etc","etc"]
[]
[]
[]
[]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Size after all agreed controls",10,20,30,40,50,null,null,null,null,"Estimate of remaining risk",10,20,30,40,50]
[]
[]
[null,"CONTROLS PROPOSED"]
[1,"Monitoring","Business monitoring report: debtors","m1"]
[2,"Monitoring","Process monitoring report: process stats","m2"]
["etc","etc","etc"]
[]
[]
[]
[]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Size after proposed controls",10,20,30,40,50,null,null,null,null,"Estimate of remaining risk",10,20,30,40,50]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,null,"xxxx"]

{"sheet":"risk analysis 1","index":2,"n_rows":10,"n_cols":10,"rows_kept":10,"cut":false,"hidden":false,"merged":[[3,1,3,2]]}
[]
[]
[]
[null,"Classification"]
["Ref","Category","Sub-category","Short name","Definition","Accountable for risk","Size with no controls","Size with existing controls","Size with controls in development too","Size with proposed new controls too"]
["r1.1",null,null,"r1","defin 1",null,10,{"$f":"controls!$Q$12","v":10},{"$f":"controls!$Q$23","v":10},{"$f":"controls!$Q$34","v":10}]
["r1.2",null,null,"r2","defin 2",null,20,{"$f":"controls!$R$12","v":20},{"$f":"controls!$R$23","v":20},{"$f":"controls!$R$34","v":20}]
["r1.3",null,null,"r3","defin 3",null,30,{"$f":"controls!$S$12","v":30},{"$f":"controls!$S$23","v":30},{"$f":"controls!$S$34","v":30}]
["r1.4",null,null,"r4","defin 4",null,40,{"$f":"controls!$T$12","v":40},{"$f":"controls!$T$23","v":40},{"$f":"controls!$T$34","v":40}]
["r1.5",null,null,"r5","defin 5",null,50,{"$f":"controls!$U$12","v":50},{"$f":"controls!$U$23","v":50},{"$f":"controls!$U$34","v":50}]

{"sheet":"risk analysis 2","index":3,"n_rows":10,"n_cols":10,"rows_kept":10,"cut":false,"hidden":false,"merged":[[3,1,3,2]]}
[]
[]
[]
[null,"Classification"]
["Ref","Category","Sub-category","Short name","Definition","Accountable for risk","Size with no controls","Size with existing controls","Size with controls in development too","Size with proposed new controls too"]
["r2.1",null,null,"r1","Defin 1",null,10,{"$f":"controls!$AA$12","v":10},{"$f":"controls!$AA$23","v":10},{"$f":"controls!$AA$34","v":10}]
["r2.2",null,null,"r2","Defin 2",null,100,{"$f":"controls!$AB$12","v":20},{"$f":"controls!$AB$23","v":20},{"$f":"controls!$AB$34","v":20}]
["r2.3",null,null,"r3","Defin 3",null,10,{"$f":"controls!$AC$12","v":30},{"$f":"controls!$AC$23","v":30},{"$f":"controls!$AC$34","v":30}]
["r2.4",null,null,"r4","Defin 4",null,100,{"$f":"controls!$AD$12","v":40},{"$f":"controls!$AD$23","v":40},{"$f":"controls!$AD$34","v":40}]
["r2.5",null,null,"r5","Defin 5",null,10,{"$f":"controls!$AE$12","v":50},{"$f":"controls!$AE$23","v":50},{"$f":"controls!$AE$34","v":50}]