Add evidence and controls
Support a risk with sources and control mappings, and maintain their verification and implementation status.
Open the Risk Register, choose a risk, and select View under Evidence & controls. You can read existing sources and controls with access to the project. Adding, editing, or removing them requires Contributor, Admin, or Owner access.
Add a supporting source
- Choose Add source.
- Select Source type: Manual note, External URL, Project file, Timeline event, or Document section.
- Select the relevant file, event, or section when that type requires one. Choices are limited to the risk's available project and artifact context.
- Add a Source title and Quote or note where useful. For an external URL, enter a valid web address. A manual note needs a title or note.
- Set Verification when you have checked the source, then choose Add source.
The source appears in the list. Open an available source link to check the underlying material. Use the source's edit control to update its details or verification, then Save source. To remove an unwanted source, use its delete control and check that it disappears from the list.
Some existing source types show their context without offering a new target selection. Follow the controls available for that source rather than replacing its context with an unrelated file or link.
If the form reports missing context, choose the required file, event, or document section. If a list cannot load, retry it. If the source list fails to refresh, choose Retry; previously loaded sources may remain visible while the refresh fails. Closing a changed source form can ask whether to discard the draft.
Map a control
In the controls area, choose Add control, enter Framework and Control ID, then choose a control status and add the mapping. Use the framework's own identifier so reviewers can find the same control in their reference material.
To update implementation progress, choose the mapping's edit-status control, select the new status, and Save. Use Cancel to abandon the change. To remove a mapping, use its remove control and confirm Remove in Remove control mapping.
A control mapping records the relationship and its status. Revisit the risk's residual scoring after reviewing the evidence for that control.