Skip to content
Blueprint Catalog

    ↑↓ move · Enter open · Esc close

    03 — Value stream · VS-190

    Risk-to-Control

    From identifying a risk or a new legal obligation to a control that is designed, operating, monitored, tested and independently audited, with every gap tracked to closure. It follows a single exposure through the three lines of defense rather than any one function's process.

    • Risk-to-Assurance
    • Obligation-to-Control
    • Governance Risk & Compliance
    • Three Lines of Defense
    // FIG. 03 · Stage flow
    1Identify Risk & O…2Decide Response &…3Embed & Operate4Monitor & Test5Audit Independent…6Remediate & Report
    1. 01

      Identify Risk & Obligation

      VS-190.10

      Capture the risk or the requirement, rate its likelihood and impact on the shared scale, and record which laws, regulations or policies it touches.

    2. 02

      Decide Response & Design Control

      VS-190.20

      Decide whether to avoid, reduce, transfer or accept the exposure within appetite, and design the control, policy or insurance that makes that choice real.

    3. 03

      Embed & Operate

      VS-190.30

      Put the control into the processes and systems that run the work, assign its owner, and train and attest the people who perform it.

    4. 04

      Monitor & Test

      VS-190.40

      Watch the indicators that show the risk is moving, and test on a schedule whether the control is designed well and operating as intended.

    5. 05

      Audit Independently

      VS-190.50

      Plan audits where a failure would hurt most, examine the control to a consistent method, and give the board an evidence-based conclusion.

    6. 06

      Remediate & Report

      VS-190.60

      Track every finding to an owned action and a date, verify the fix, and report the residual position to leadership, the board and regulators.