Every control owned, tested and proven.
One register for your own controls, with versioned definitions, scoped RACI, assurance tests that count only after independent review, evidence requirements with validity periods, and an effectiveness view explained line by line.
| Control | Description | Owner | Frequency |
|---|---|---|---|
| C-AC-04 | Quarterly access recertification | IT Ops | Quarterly |
| C-CR-02 | Encryption of data at rest | Platform | Continuous |
| C-VM-01 | Monthly vulnerability scanning | SecOps | Monthly |
| C-HR-03 | Leaver access removed in 24h | HR / IT | Event |
| C-BC-01 | Annual BCP test | Resilience | Annual |
Illustration with sample data
What Control Register, Testing & RACI does
The Control Register holds each control's lifecycle from Draft to Retired, with versions so that every test stays tied to the definition it ran against. Written procedures need an approver other than the author. RACI covers Owner, Operator, Reviewer, Approver, Consulted, Informed, Evidence Owner and Tester, and a role can be scoped to the whole control, an asset, a process or a data classification. RACI drives approvals and alerts but never grants access. An enterprise control can have local implementations in subsidiaries, each with its own owner, tests and evidence.
Assurance testing supports inspection, inquiry, observation, re-performance, sampling, automated and continuous methods. The tester and the reviewer are different people, and a result that needs review counts only after someone else approves it. Evidence requirements carry validity periods and an independent reviewer. Control exceptions take two steps, the control's Approver and then a CISO, and they expire. Design, implementation, operating, evidence, automation and health ratings are derived and explained, never stored by hand.
Key capabilities
Lifecycle & versions
Draft → Under Review → Approved → Active → Under Revision → Retired.
Scoped RACI
Roles per control, asset, process or data classification, with dates and history.
Assurance testing
Seven methodologies, population and sample recorded, independent review.
Evidence requirements
Validity periods, independent acceptance and revalidation reminders.
Control exceptions
Two-step approval, never by the requester, with automatic expiry.
Derived effectiveness
Design, implementation, operating, evidence, automation and health, explained.
The business case.
Efficiency, multi-framework alignment, reduced complexity and streamlined processes: what Control Register, Testing & RACI changes for your programme.
Less testing admin
Calendars, reminders, reviews and evidence reuse remove most coordination work.
Built into every step
Testers, reviewers, approvers and requesters are always different people.
Accepted evidence counts everywhere
Evidence accepted for a control proves every requirement it maps to.
No black boxes
Every effectiveness rating shows the facts behind it.
Efficiency figures compare the effort of each workflow cycle in RiskVantis with the same work done manually or in a traditional GRC tool. Your result depends on your starting point; we will model it with you in a demo.
From setup to outcome.
Define
Write the control, its procedure and RACI.
Test
Plan tests, record results and get them reviewed.
Evidence
Collect and accept evidence against requirements.
Monitor
Watch health, exceptions and effectiveness.
Supports your obligations.
Control Register, Testing & RACI contributes evidence and coverage to these frameworks and regulations.
Common questions.
Can a tester approve their own test result?
No. When review is required, a result counts only after someone other than the tester approves it.
Does holding a RACI role give access to records?
No. RACI decides who acts in workflows. Access comes from personas and permissions.
Can we import controls from Excel?
Yes. Export, edit and import requirements, controls and mappings through a preview and commit that never removes existing mappings.
Works better together.
Enterprise Compliance Posture
Compliance status in RiskVantis is calculated, never typed in. Every requirement, in every organisation, shows its status, why it has that status and what would change…
Learn more →Compliance ManagementPolicy-as-Code & Continuous Monitoring
Run automated technical rules against the data RiskVantis already collects from Microsoft Entra ID, Microsoft 365, your assets and privacy records. Start from a rule…
Learn more →Control Assurance & Security ReviewsDesign Effectiveness Testing
Model your processes, test each control's design against the risks it should address, and let AI suggest the risks and the test procedure. Only the gaps you approve…
Learn more →See Control Register, Testing & RACI in action.
Book a 30-minute walkthrough tailored to your frameworks, vendors and team.