XXXXXX XXXXXX XXXXXX

Risks and controls tracker

Sr. No.: 21
Risk Owner: Mr. xxxxxxxxxxxxxx
KPI Tracker
Department: Cross Functional Risk KPIs Budget Actual Variance % Remarks
Risk Category: Strategic
% Data centre up time 100.00 -100.00%

% availability of data (based on data loss reported) 100.00 -100%

Inappropriate data capturing and storage
Risk Description: mechanism resulting in loss of data as well as
critical opportunities % Data back up availability 100.00 -100%
% success of mock drills 100.00 -100%
% availability of documents reported 100.00 -100%

Root Cause
1. List of documents stored in the safes, cupboards not maintained properly leading to risk of misplacement/ loss of documents
2. Inadequate process for data backup
2. No fire proof safe.

Is Risk
Control
Control / Action Plan Description Action Plan Status Due Date Criticality Weightage
Operational
(Y/N)
1. The Online and Offline Backup of SAP Servers are scheduled daily
and taken on tape cartridges and stored on secured location
High 40%

2. Monitoring data replication at the DR site (offsite location)

Medium 10%

3. Conduct mock drills for DR site readiness on half yearly basis

Low 10%
Non IT related documents (Owner : xxxxxxxxxx)
4. Document retention policy to be documented and implemented
including key contracts, licenses,etc having financial, legal and statutory
implications All the documents including confidential documents to be
stored in safes, cupboards. A list to be maintained for documents stored
in the cupboards,etc and the access to these records, the list of High 30%
documents stored in the cupboards would be with authorized personnel

Inherent Risk
Exposure
8 Residual Risk Exposure 2

Weight of the Control 6 Original Risk Control Effectiveness (RCE) 75%

Quarter 2 - RCE 69% Revised Residual Risk Exposure (Qtr 2) 2.48 Remarks
1. Incidents, 2. KPI Performance, 3. IA &
MIS reports, 4. Controls
Assessment done based upon feedback provided
Quarter 3 - RCE 69% Revised Residual Risk Exposure (Qtr 3) 2.48 Remarks by VP(F&A) & GM(IT&S) for Q3

1. Incidents, 2. KPI Performance, 3. IA &

MIS reports, 4. Controls
Quarter 4 - RCE Revised Residual Risk Exposure (Qtr 4) 8 Remarks
1. Incidents, 2. KPI Performance, 3. IA & MIS
reports, 4. Controls

Sign off - Assessor Sign off - Reviewer