Purpose & boundaries
This sample shows how a risk can be connected to a control objective, an accountable owner and the evidence needed for review. It uses a fictional small organization rather than employer or client data.
The register entries are examples for discussion. Their ratings are illustrative judgments, not the output of a real organizational assessment. The test plan is a proposed procedure, with results deliberately left as “Not tested.”
Illustrative risk register
The sample separates the risk scenario from the proposed action and makes unresolved work visible. Residual risk is not assumed to improve merely because a treatment has been proposed.
| ID / area | Risk scenario | Proposed treatment | Status |
|---|---|---|---|
| R-01 Access | A departed user retains access because offboarding is not consistently recorded. | Introduce an approved offboarding record and reconcile it with account status. | Proposed |
| R-02 Recovery | Recovery capability is uncertain because no recent restoration evidence is available. | Define an approved restore exercise and retain its results and corrective actions. | Proposed |
| R-03 Supplier | Supplier access persists without an identified business owner. | Assign an owner and review access need, scope and expiry. | Proposed |
The downloadable CSV adds illustrative likelihood and impact ratings, evidence to request, proposed owners and explicit residual-risk status. It is a learning sample, not a prescribed scoring methodology.
Open sample register (CSV)Sample test plan: user offboarding
- Objective
- Determine whether sampled leaver accounts were disabled within the organization’s approved offboarding timeframe.
- Criteria
- Use the actual approved policy and authorized termination time. Do not invent a universal deadline.
- Population
- All leavers in an agreed review period. Obtain the authoritative leaver list and reconcile its completeness before selecting a sample.
- Evidence requested
- Authorized termination records, offboarding tickets, account-disable timestamps, relevant application records and documented exceptions.
- Proposed procedure
- Agree the sample rationale, compare each required action with supporting evidence, record exceptions and route follow-up to the control owner.
- Result
- Not tested. No population, evidence or sample has been examined for this fictional example.
- Remediation follow-up
- If a real test identifies an exception, document the action, owner and due date, then review closure evidence rather than assuming resolution.
What a reviewer should be able to trace
- Which risk the control is intended to address.
- What criteria would be used to assess the control.
- Where the evidence would come from and what it would establish.
- Which judgments and limitations need to be recorded.
- Who would own the response to an exception.
In a real engagement, scope, access permissions, sampling and review responsibilities would need to be agreed before executing this plan.