Module Overview
The Control Library is the central repository for all organizational controls, featuring automated effectiveness tracking, role-based notifications, escalation workflows, and comprehensive reporting for internal control management.
What is Control Library?
The Control Library module enables organizations to maintain a centralized repository of internal controls, track their effectiveness through automated testing, and ensure timely testing through intelligent notifications and escalation workflows.
Central Repository
Single source of truth for all organizational controls organized by framework
Effectiveness Tracking
Automated calculation of control effectiveness scores from test results
Smart Notifications
Role-based notifications for control team, owners, and management
Comprehensive Reports
Detailed analytics on control testing, effectiveness, and compliance
Control Management Lifecycle
Key Feature
Control effectiveness is automatically calculated from test results using a 5-point scale (0-5). Failed tests trigger immediate notifications to control owners and the control team.
Key Features
What Control Library Provides
Framework Organization
Controls organized by frameworks (COBIT, ISO, SOX) and checklists
Automated Testing
Test results from audit fieldwork automatically update control scores
Role-Based Access
Control team, control owners, and management have appropriate access
Smart Notifications
Automated emails for overdue, upcoming, and failed control tests
Escalation Workflow
Overdue controls (>7 days) escalated to department heads
Analytics Dashboard
Comprehensive reports on testing compliance and effectiveness
Control Structure
Understanding how controls are organized and categorized in the library.
Control Attributes
Each control in the library contains comprehensive attributes for effective management and testing.
| Attribute | Description | Example |
|---|---|---|
| Control ID | Unique identifier for the control | AC-01, IT-05, FIN-12 |
| Control Title | Descriptive name of the control | "User Access Review Control" |
| Control Objective | What the control aims to achieve | "Ensure only authorized users have access" |
| Control Description | Detailed description of control activity | "Quarterly review of all user access rights" |
| Control Type | Manual, IT-Dependent, Application, or IT General | Application |
| Control Nature | Preventive, Detective, or Corrective | Preventive |
| Test Frequency | How often the control should be tested | Quarterly, Annual, Continuous |
| Control Owner | User responsible for the control | IT Manager |
Control Categories
Financial Reporting
Controls over financial reporting and disclosure
Operational
Controls over operational processes and efficiency
Compliance
Controls ensuring regulatory compliance
Information Security
Controls protecting information assets
Quality Assurance
Controls ensuring quality standards
Environmental
Controls for environmental compliance
Organization Tip
Organize controls by framework for easy mapping to compliance requirements. Use consistent naming conventions (e.g., AC for Access Controls, IT for IT General Controls) for easy identification.
Effectiveness Tracking
Automated calculation and tracking of control effectiveness scores.
How Effectiveness is Calculated
Control effectiveness is automatically calculated based on test results using a standardized 5-point scale.
Test Result to Score Mapping
| Test Result | Effectiveness Score | Percentage | Interpretation |
|---|---|---|---|
| Passed | 4/5 | 80% | High Effectiveness |
| Not Testable | 2/5 | 40% | Limited Effectiveness |
| Failed | 1/5 | 20% | Low Effectiveness |
| Exception | 0/5 | 0% | Ineffective |
| Pending | 0/5 | 0% | Not Tested |
Average Effectiveness Calculation
Effectiveness Interpretation
| Score Range | Rating | Color | Action Required |
|---|---|---|---|
| 4.0 - 5.0 | Highly Effective | Green | Continue monitoring |
| 2.5 - 3.9 | Moderately Effective | Yellow | Review and improve |
| 0.0 - 2.4 | Ineffective | Red | Immediate remediation |
Automatic Updates
Effectiveness scores are automatically recalculated whenever:
• A new test result is recorded
• An existing test result is updated
• A test is manually recalculated
• Audit fieldwork is completed
Notifications System
Role-based automated notifications ensure timely control testing and immediate awareness of issues.
Notification Types
The system sends three types of notifications based on control testing status and timing.
Upcoming Tests
Sent 7 days before due date
Control Team
Overdue Tests
Sent when past due date
Control Team
Owner
Failed Tests
Sent when control fails testing
Control Team
Owner
Notification Recipients
| Notification Type | Control Team | Control Owner | Department Head |
|---|---|---|---|
| Upcoming (7 days) | ❌ | ❌ | |
| Overdue (1-7 days) | ❌ | ||
| Overdue (>7 days) | ✅ Escalation | ||
| Failed Test | ❌ |
Notification Frequency
Permission-Based
Notifications are sent ONLY to users with appropriate permissions:
• Control Team: Users with control_library_view or control_management
• Department Heads: Users with admin_user_management or admin_settings_edit
• Control Owners: Assigned control owners
Escalation Workflow
Automatic escalation to management for critical overdue controls ensures accountability and timely resolution.
Escalation Triggers
Controls are automatically escalated based on the number of days overdue for testing.
Escalation Flow
Day 0
Day 1-7
Team + Owner
Day 8+
+ Management
Escalation Levels
| Days Overdue | Severity | Recipients | Email Subject |
|---|---|---|---|
| 1-7 days | HIGH | Control Team + Owner | [OVERDUE] Control Test Required |
| >7 days | CRITICAL | Team + Owner + Dept Heads | [ESCALATION] Critical Overdue Control |
Escalation Email Content
Escalation emails to department heads include:
- Control Details: ID, title, category, owner
- Overdue Duration: Number of days overdue
- Compliance Impact: Risk exposure statement
- Management Actions: Specific steps required
- Direct Link: Quick access to control details
Accountability Tracking
All escalations are logged in the control_notifications
table with timestamps, providing an audit trail for compliance
and performance reviews.
Reporting Module
Comprehensive analytics and insights on control testing, effectiveness, and compliance.
Access Control Reports
Navigate to Control Reports from the Control Library
page. Requires control_management or admin_settings_edit permission.
Report Sections
Summary Metrics
6 key metrics: Total Controls, Tests Completed, Avg Effectiveness, Overdue, Failed, Compliance Rate
Overdue Controls
Detailed list of overdue tests with owner, due date, and days overdue
Failed Controls
List of failed controls with effectiveness scores and remediation status
Effectiveness by Category
Breakdown of control effectiveness by category (Financial, IT, Compliance, etc.)
Owner Performance
Control owner metrics: number of controls, avg score, overdue count
Testing Trends
6-month trend analysis of testing compliance and pass/fail rates
Report Features
| Feature | Description | Benefit |
|---|---|---|
| Date Range Filter | Select custom start and end dates | Focus on specific reporting periods |
| CSV Export | Export all data to spreadsheet format | Further analysis and board presentations |
| Print Layout | Print-friendly formatting | Professional reports for meetings |
| Visual Indicators | Color-coded badges and progress bars | Quick identification of issues |
Export Options
Reports can be exported to CSV for:
• Board and audit committee presentations
• Regulatory compliance submissions
• Trend analysis in Excel
• Integration with other reporting tools
Industry-Adaptive Upgrade
Configure Control Library features based on your industry requirements.
New Feature!
The Control Library module now supports industry-adaptive features that can be toggled on/off based on your regulatory requirements. Run the upgrade script to access these features.
Upgrade Script
To enable industry-adaptive features, run the upgrade script:
This will add:
- Directive control category (always available)
- Design Quality Assessment fields (toggle on/off)
- Testing Type Hierarchy fields (toggle on/off)
- Control Independence Testing (toggle on/off)
- Smart Sample Size Calculation (toggle on/off)
- Poor Design Detection (toggle on/off)
Industry Presets
Quick-configure features for your industry:
| Industry | Design Quality | Testing Types | Independence | Sample Size | Poor Design |
|---|---|---|---|---|---|
| Financial Services | ✅ | ✅ | ✅ | ✅ | ✅ |
| Healthcare | ✅ | ✅ | ❌ | ❌ | ✅ |
| Manufacturing | ❌ | ✅ | ❌ | ✅ | ❌ |
| Tech | ❌ | ❌ | ❌ | ❌ | ❌ |
| General | ❌ | ❌ | ❌ | ❌ | ❌ |
Feature Details
Always Available - No toggle required
Fourth control nature alongside Preventive, Detective, and Corrective.
Definition: Controls that specify what must be done through policies, procedures, guidelines, and training.
Examples:
- Employee code of conduct
- Security awareness training
- Standard operating procedures
- Regulatory compliance guidelines
Toggle: control_enable_design_quality
Assess control design quality BEFORE testing effectiveness.
Rating Scale:
- Poor - Control needs redesign (do not test)
- Fair - Control has issues but can be tested
- Good - Control is well-designed
- Excellent - Control is exemplary
When to Enable:
- ✅ Financial Services - Required by regulators
- ✅ Healthcare - HIPAA compliance
- ✅ Public Companies - SOX compliance
- ❌ Tech Startups - May be overkill
Toggle: control_enable_testing_types
Weight control tests based on reliability (from IIA standards).
Hierarchy (Most to Least Reliable):
- Reperformance (100% weight) - Mystery shopping, redo calculation
- Examination (70% weight) - Document review
- Observation (50% weight) - Physical observation
- Inquiry (20% weight) - "Pinky promise" - least reliable
Effectiveness Calculation:
Toggle: control_enable_independence
Test independence between controls to calculate joint failure rate.
Concept:
- 4 independent controls with 10% failure rate each = 0.01% joint failure (10%^4)
- 4 dependent controls with 10% failure rate = 10% joint failure (no diversification)
Independence Types:
- Fully Independent (correlation = 0.0) - Fail independently
- Partially Dependent (correlation = 0.5) - Some common failure modes
- Fully Dependent (correlation = 1.0) - Fail together
Toggle: control_enable_sample_size
Suggest sample sizes based on population homogeneity.
Formula:
- High Homogeneity (>80% same): Sample 10% (min 25, max 100)
- Medium Homogeneity (50-80%): Sample 20% (min 40, max 150)
- Low Homogeneity (<50%): Sample 30% (min 60, max 200)
Toggle: control_enable_poor_design_detection
Automatically detect poor control designs that provide false sense of security.
Detection Patterns:
- Optimistic Controls (High Severity)
- Rely on "incredible level of motivation"
- Examples: Terms & conditions, policy sign-offs without verification
- Duplicative Controls (Medium Severity)
- Multiple people checking same thing
- "Four eyes" becomes "ten eyes"
- Dilutes accountability
- More of the Same (High Severity)
- Reinforcing failed controls without redesign
- Adding third checker when two already failed
Full Documentation
For complete upgrade documentation, see:
http://localhost/stratagrc/CONTROL_LIBRARY_UPGRADE_GUIDE.md
Module Integrations
How Control Library connects with other StrataGRC modules.
Integration Points
Audit Management
Fieldwork results automatically update control effectiveness scores. Failed controls can trigger audit findings.
Risk Register
Controls are linked to risks. Control failures increase risk scores and trigger risk reassessments.
Frameworks
Controls mapped to compliance frameworks (COBIT, ISO 27001, SOX) for compliance tracking.
Notifications
Integrated notification system sends emails and logs to control_notifications table.
Data Flow Example
Real-Time Updates
All integrations are real-time. When a control is tested during audit fieldwork, the effectiveness score is immediately updated, notifications are sent if needed, and reports reflect the change.
Best Practices
Guidelines for effective control management based on industry standards.
Control Management Guidelines
Define Clear Control Objectives
Each control should have a clear, measurable objective. Avoid vague statements. Example: "Ensure all new employees complete security training within 5 days of hire" instead of "Ensure employees are trained."
Assign Competent Owners
Control owners should have:
- Authority over the control activity
- Knowledge of the control requirements
- Time to perform control activities
- Access to necessary resources
Set Appropriate Test Frequency
Match test frequency to control risk:
- High Risk: Monthly or Quarterly testing
- Medium Risk: Quarterly or Semi-Annual
- Low Risk: Annual testing
Document Test Procedures
Each control should have documented test procedures including:
- Sample size requirements
- Testing methodology
- Evidence requirements
- Pass/fail criteria
Monitor Effectiveness Trends
Review control effectiveness trends monthly:
- Identify declining effectiveness early
- Investigate root causes
- Implement improvements
- Track remediation progress
Respond to Failed Controls
When controls fail:
- Notify stakeholders immediately
- Assess impact on risk exposure
- Develop remediation plan
- Implement compensating controls if needed
- Re-test after remediation
Compliance Standards Alignment
COSO Internal Control Framework:
• Control Activities: Control design and implementation
• Information & Communication: Control documentation and communication
• Monitoring Activities: Ongoing and separate evaluations
• Control Deficiencies: Deficiency identification and remediation
COBIT 2019 (IT Controls):
• BAI06: Manage organizational project capacity
• DSS06: Manage business process controls
• MEA02: Monitor, evaluate and assess the system of internal control
• Control Objectives: IT control objectives and metrics
ISO 27001 Information Security:
• Annex A Controls: 114 security controls in 14 domains
• A.12 Operational Security: Operational controls and procedures
• A.18 Compliance: Compliance with policies and standards
• Control Testing: Regular control effectiveness testing
SOX Section 404 (Internal Controls):
• Control Documentation: Control documentation requirements
• Control Testing: Testing of internal controls over financial reporting
• Deficiency Evaluation: Control deficiency identification and evaluation
• Remediation: Control deficiency remediation and re-testing
King IV Report on Corporate Governance:
• Principle 15: Governing body should ensure assurance services
• Internal Control: Internal control system and internal audit
• Risk Management: Risk management and internal control integration
Industry Resources
For more detailed guidance on control management:
• COSO: Internal Control - Integrated Framework
• ISACA: COBIT Framework and Control Objectives
• ISO: ISO/IEC 27001 Information Security Management
• PCAOB: Auditing Standard No. 5 - Internal Control Audit