{"text_format":"1","workbook":"xlsx","n_sheets":2,"sheets":["instructions","matrix"],"not_rendered":{"charts":0,"images":0,"macros":1,"external_links":0,"defined_names":0,"comments":1,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"instructions","index":0,"n_rows":36,"n_cols":2,"rows_kept":36,"cut":false,"hidden":false,"merged":[]}
[]
[null,"Simple risk control matrix"]
[]
[null,"For a good introduction tof this kind of risk-control matrix refer to the web page \"Matrix Mapping: the easiest and best way to map internal controls\" at www.workinginuncertainty.co.uk/matrices.shtml"]
[]
[null,"The main advantage of this style is that it allows you to cope, easily, with the common situation of having a many:many relation between risks and controls."]
[]
[null,"This template has two features not described in that article."]
[]
[null,"First, in this template there are three distinct groups of controls: those already in place, those agreed but not yet operating (i.e. in development), and those proposed but not yet agreed on."]
[]
[null,"After each set of controls there are revised summaries of the level of control provided."]
[]
[null,"Second, there is space for two risk analyses.  There's no need to do two, but if alternative perspectives could be useful there's no reason for not using both together and mapping controls to both of them."]
[]
[null,"Furthermore, if you want to migrate from one risk analyis to another, having the ability to show two during a changeover period might be very useful."]
[]
[]
[null,"Several columns are provided for capturing information about controls and you can use, ignore, or add to them as you wish."]
[]
[null,"One limitation of this style is that your risk analyses have to be documented in the column headings and comments of the controls sheet.  If you want to say more than this then you might be interested in the 'general rc matrix.xls' design, which includes separate sheets for risk analyses and macro buttons to bring the control and risk analysis sheets into alignment automatically."]
[]
[null,"You need to decide what metric(s) of risk 'size' you will use and update the headings to make clear what your choice is.  I've just used the word 'size' as a place holder."]
[]
[null,"Please feel free to contact me with any queries or suggestions at matthew@workinginuncertainty.co.uk"]
[]
[]
[null,"Important note"]
[]
[null,"Risk management is much more than listing risks and mapping them to controls. This tool is just a small part of your total approach and should only be used where appropriate."]
[]
[null,"Typically, that means it should be used to check the coverage of 'controls' or rather to think about the performance of a process design against potential challenges or regulations."]
[]
[null,"Risk control mapping is best applied where the 'risks' are small and not connected to each other. If 'risks' tend to trigger each other then it is wrong to pretend that they are separate things and this mistake will cause you to underestimate your risk systematically."]
[]
[null,"To make a real difference to management of risk you should focus on making incremental improvements to the way core management activities are done so that their performance under uncertainty is improved."]

{"sheet":"matrix","index":1,"n_rows":98,"n_cols":34,"rows_kept":98,"cut":false,"hidden":false,"merged":[[3,14,3,15],[3,25,3,26]]}
[]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Risk analysis 1 number",null,null,"Coverage check using risk analysis 1",null,null,null,null,null,null,null,"Risk analysis 2 number",null,null,"Coverage check using risk analysis 2"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,2,null,null,"Risk ref","r1.1","r1.2","r1.3","r1.4","r1.5",null,null,1,null,null,"Risk ref","r1.1","r1.2","r1.3","r1.4","r1.5"]
["Sort","Control group","Control","Control ID","Ref to detail","Owner - operational","Owner - development","Frequency","Sampling","To do date","Performance evidence","Perform-ance rating","Operation cost","Development cost",{"$f":"INDEX($S4:$W4,1,$O$3)","v":"r2"},null,null,"Short name","r1","r2","r3","r4","r5",null,null,{"$f":"INDEX($AD4:$AH4,1,$Z$3)","v":"r1.1"},null,null,"Short name","r1.1","r2","r3","r4","r5"]
[]
[null,"CONTROLS CURRENTLY IN PLACE",null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(INDEX(S6:W6,1,O$3)<>0,B6,\"\")","v":""},null,null,null,null,null,null,null,null,null,null,{"$f":"IF(INDEX(AD6:AH6,1,Z$3)<>0,M6,\"\")","v":""}]
[1,"Monitoring","Business monitoring report: debtors","m1",null,null,null,null,null,null,null,null,null,null,{"$f":"IF(INDEX($S7:$W7,1,$O$3)<>0,B7,\"\")","v":"Monitoring"},"Business monitoring report: debtors",null,null,null,1,null,null,null,null,null,{"$f":"IF(INDEX($AD7:$AH7,1,$Z$3)<>0,B7,\"\")","v":""},{"$f":"IF(INDEX($AD7:$AH7,1,$Z$3)<>0,C7,\"\")","v":""},null,null,null,1]
[2,"Monitoring","Process monitoring report: process stats","m2",null,null,null,null,null,null,null,null,null,null,"","",null,null,1,null,null,null,null,null,null,{"$f":"IF(INDEX($AD8:$AH8,1,$Z$3)<>0,B8,\"\")","v":"Monitoring"},{"$f":"IF(INDEX($AD8:$AH8,1,$Z$3)<>0,C8,\"\")","v":"Process monitoring report: process stats"},null,null,1]
["etc","etc","etc",null,null,null,null,null,null,null,null,null,null,null,"etc","etc",null,null,null,1,null,null,null,null,null,{"$f":"IF(INDEX($AD9:$AH9,1,$Z$3)<>0,B9,\"\")","v":""},{"$f":"IF(INDEX($AD9:$AH9,1,$Z$3)<>0,C9,\"\")","v":""},null,null,null,1]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,"","",null,null,null,null,null,null,null,null,null,"",""]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,"","",null,null,null,null,null,null,null,null,null,"",""]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Size after existing controls",10,20,30,40,50,null,null,null,null,null,"Size after existing controls",10,20,30,40,50]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Size if existing controls failed",20,60,60,90,60,null,null,null,null,null,"Size if existing controls failed",20,60,60,90,60]
[]
[]
[null,"CONTROLS IN DEVELOPMENT"]
[1,"Monitoring","Business monitoring report: debtors","m1",null,null,null,null,null,null,null,null,null,null,{"$f":"IF(INDEX($S17:$W17,1,$O$3)<>0,B17,\"\")","v":""},"",null,null,1,null,null,null,null,null,null,{"$f":"IF(INDEX($AD17:$AH17,1,$Z$3)<>0,B17,\"\")","v":"Monitoring"},{"$f":"IF(INDEX($AD17:$AH17,1,$Z$3)<>0,C17,\"\")","v":"Business monitoring report: debtors"},null,null,1]
[2,"Monitoring","Process monitoring report: process stats","m2",null,null,null,null,null,null,null,null,null,null,"","",null,null,null,null,null,null,null,null,null,{"$f":"IF(INDEX($AD18:$AH18,1,$Z$3)<>0,B18,\"\")","v":""},{"$f":"IF(INDEX($AD18:$AH18,1,$Z$3)<>0,C18,\"\")","v":""}]
["etc","etc","etc",null,null,null,null,null,null,null,null,null,null,null,"","",null,null,null,null,null,null,null,null,null,"",""]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,"","",null,null,null,null,null,null,null,null,null,"",""]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,"","",null,null,null,null,null,null,null,null,null,"",""]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,"","",null,null,null,null,null,null,null,null,null,"",""]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,"","",null,null,null,null,null,null,null,null,null,"",""]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Size after all agreed controls",10,20,30,40,50,null,null,null,null,null,"Size after all agreed controls",10,20,30,40,50]
[]
[]
[null,"CONTROLS PROPOSED"]
[1,"Monitoring","Business monitoring report: debtors","m1",null,null,null,null,null,null,null,null,null,null,{"$f":"IF(INDEX($S28:$W28,1,$O$3)<>0,B28,\"\")","v":""},"",null,null,null,null,null,null,null,null,null,{"$f":"IF(INDEX($AD28:$AH28,1,$Z$3)<>0,B28,\"\")","v":""},{"$f":"IF(INDEX($AD28:$AH28,1,$Z$3)<>0,C28,\"\")","v":""}]
[2,"Monitoring","Process monitoring report: process stats","m2",null,null,null,null,null,null,null,null,null,null,"","",null,null,1,null,null,null,null,null,null,{"$f":"IF(INDEX($AD29:$AH29,1,$Z$3)<>0,B29,\"\")","v":"Monitoring"},{"$f":"IF(INDEX($AD29:$AH29,1,$Z$3)<>0,C29,\"\")","v":"Process monitoring report: process stats"},null,null,1]
["etc","etc","etc",null,null,null,null,null,null,null,null,null,null,null,"","",null,null,null,null,null,null,null,null,null,"",""]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,"","",null,null,null,null,null,null,null,null,null,"",""]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,"","",null,null,null,null,null,null,null,null,null,"",""]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,"","",null,null,null,null,null,null,null,null,null,"",""]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,"","",null,null,null,null,null,null,null,null,null,"",""]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Size after proposed controls",10,20,30,40,50,null,null,null,null,null,"Size after proposed controls",10,20,30,40,50]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,null,"xxxx"]