XXXXXX XXXXXX XXXXXX

Risks and controls tracker

Sr. No.: 21
KPI Tracker
Risk Owner: Mr. xxxxxxxxxxxxxx
Department: Cross Functional Risk KPIs Budget Actual Variance % Remarks
Risk Category: Strategic
% Data centre up time 100.00 -100.00%

% availability of data (based on data loss

reported) 100.00 -100%
Inappropriate data capturing and storage
Risk Description: mechanism resulting in loss of data as well
as critical opportunities % Data back up availability 100.00 -100%

% success of mock drills 100.00 -100%

% availability of documents reported 100.00 -100%

Root Cause
1. List of documents stored in the safes, cupboards not maintained properly leading to risk of misplacement/ loss of documents
2. Inadequate process for data backup
2. No fire proof safe.

Is Risk
Control
Control / Action Plan Description Action Plan Status Due Date Criticality Weightage
Operationa
l (Y/N)
1. The Online and Offline Backup of SAP Servers are scheduled
daily and taken on tape cartridges and stored on secured location
High 40%

2. Monitoring data replication at the DR site (offsite location)

Medium 10%

3. Conduct mock drills for DR site readiness on half yearly basis

Low 10%
Non IT related documents (Owner : xxxxxxxxxx)
4. Document retention policy to be documented and implemented
including key contracts, licenses,etc having financial, legal and
statutory implications All the documents including confidential
documents to be stored in safes, cupboards. A list to be
High 30%
maintained for documents stored in the cupboards,etc and the
access to these records, the list of documents stored in the
cupboards would be with authorized personnel

Inherent Risk 8 2
Residual Risk Exposure
Exposure

Weight of the 6 75%

Original Risk Control Effectiveness (RCE)
Control

Quarter 2 - RCE 69% Revised Residual Risk Exposure (Qtr 2) 2.48 Remarks
1. Incidents, 2. KPI Performance, 3. IA & MIS
reports, 4. Controls
Assessment done based upon feedback
Quarter 3 - RCE 69% Revised Residual Risk Exposure (Qtr 3) 2.48 Remarks provided by VP(F&A) & GM(IT&S) for Q3

1. Incidents, 2. KPI Performance, 3. IA & MIS

reports, 4. Controls
Quarter 4 - RCE Revised Residual Risk Exposure (Qtr 4) 8 Remarks
1. Incidents, 2. KPI Performance, 3. IA & MIS
reports, 4. Controls

Sign off - Assessor Sign off - Reviewer