Risks and controls
Bau24 supports building a complete risk and control system inside the audit engagement. You define the risks the organisation is exposed to and the control activities that address them, then link risks and controls to each other so the map of the system is always visible: which control covers which risk, which risk has no control in place, and where a single control serves several risks.
Both risks and controls are classified according to COSO — by component, category and the criteria they relate to — so the output of the work is directly usable in reporting and in communication with those charged with governance. Control activities are assessed for design and for implementation, and each assessment is stored with the evidence supporting it.
Each risk is tracked in three distinct states, so the effect of the control system is measured rather than assumed:
Inherent risk
The exposure as it exists before any control activity is taken into account. It reflects the nature and size of the event itself and is the starting point of the assessment.
Risk with controls before testing
The exposure after the designed controls are considered, but before they have been tested. It shows what the system is intended to achieve and where the design already reduces the exposure.
Residual risk
The exposure that remains once the controls have been tested and their actual effectiveness assessed. This is the risk the auditor finally evaluates and the basis for the audit response.
Comparing the three states shows where controls genuinely reduce exposure and where they exist only on paper, and the reasoning behind every assessment stays documented for review.