Control Mapping Pro — Connect Risks, Processes & Controls

Control mapping summary

The supplied controls address the stated internal approval requirement through preventive and detective layers. Design is described but operation is unverified; no compliance or effectiveness conclusion is justified.

Relationship records

RQ1 → purchase-order process → approval/release steps → R1 → C1 and C2. C1 and C2 both map to RQ1 and R1; retain those links instead of duplicating the risk. No external framework, clause, key-control designation or risk rating is assigned.

Gaps and remediation

G1: identify the business approval owner and authorized manager roles. G2: document C2 performer, report population, review deadline and escalation. G3: obtain evidence of operation before assessing effectiveness. G4: verify whether changes to ERP threshold and role configuration are reviewed; a change-control requirement is not assumed to exist.

Proposed testing plan — not executed

For C1, inspect configuration and test a controlled sample at $5,000 and above $5,000, with and without approval, including authorized overrides. The stated requirement says above $5,000; exactly $5,000 is outside that threshold unless another rule applies. Check approval timestamp precedes release. For C2, reconcile the monthly report population to released POs, inspect dated review and trace exception follow-through. Agree safe test environment and approval with the responsible team.

Open fields

Risk owner, inherent/residual ratings, report performer, escalation route, last review date and test results remain unknown. No systems were accessed or tests run; this is a proposed mapping for owner validation.