Internal Control record management

Redwood Platform

Internal Controls provides a central repository for documented internal controls. Each control record includes a control definition, related processes, risks, categories, stakeholders, comments, attachments, activities, related algorithms, and related internal controls. Use templates to configure control records and manage record-level stakeholder access.

  • View internal controls by reference code, control name, short description, primary control owner, process, and status.
  • Search, sort, filter, and select internal control records. Filter chips are available for reference code, control name, process, control owner, status, and other control attributes.
  • Create control definitions from a template. Templates determine the sections, attributes, and required values for a control.
  • Switch between summary and expanded views to review control definitions and related information.
  • Share internal controls and manage stakeholders for one or more selected records.
  • Use available actions, based on record status and authorization, to publish, edit, copy, archive, move records to the trash, restore records, and request access.
  • Run the Risk Report to export published documented internal controls, including available attributes and relationships for each record.

Business benefit

Centralizing internal control records improves visibility and consistency across Risk Management. Teams can maintain control relationships, ownership, and status in one workspace.

Steps to enable and configure

To navigate to this feature:

  1. From the Fusion Applications Newsfeed home page, open Risk Management.
  2. Select Internal Controls module.

Tips and considerations

  • The list initially displays Published controls alphabetically by control name.
  • Editing a control moves it to Draft.
  • The template selected when a control is created can't be changed.
  • Users can export only controls they are authorized to view.

Access requirements

Internal Controls access is controlled through Stakeholders. Users can view only internal controls for which they have explicit authorization. When the All Employees participant group is assigned, users can view the internal controls in the list. Additional actions, including edit and copy, depend on the user’s authorization and applicable privileges.

For access details, refer to Risk Management secured record access framework in this What’s New.