# Risk and control record

Author: Adrian Sutherland  
Edition: Version 1.0  
Prepared: September 2026  
Copyright: © 2005–2026 Adrian Sutherland

Replace prompts with your own decisions, sources and results. Link existing records where useful.

## Scope and source

Name the service, people, assets and source records.

## Harm and assumptions

Describe the harmful event, weaknesses and assumptions.

## Controls and ownership

Name the controls for prevention, detection and recovery, and who operates each.

## Assurance and remaining risk

State the required checks, their actual results and who may accept the remaining risk.

## Change and review

Record review triggers, dependencies and versions.