Risk and controls register
Four states, and the distance between designed and independently tested is where most registers overstate themselves.
Four states, and the difference between them matters
- Not in place. The control does not exist.
- Designed only. It exists on paper and has not been shown to have operated.
- Operating, evidenced. There is evidence it operated during the period.
- Independently tested. Someone outside the team that operates it has tested it.
A control that exists on paper and has never been exercised has produced no evidence of anything. Most self-assessments blur that into “operating”, which is how a register comes to look healthier than the operation it describes.
Biodiversity: 0 of 2 independently tested
Climate physical risk: 0 of 2 independently tested
Climate transition risk: 0 of 3 independently tested
Closure: 0 of 2 independently tested
Cultural heritage: 0 of 3 independently tested
Disclosure integrity: 0 of 4 independently tested
Human rights: 0 of 3 independently tested
Safety: 0 of 2 independently tested
Tailings: 0 of 5 independently tested
Water: 0 of 2 independently tested