--- id: v9-create-and-track-risk-controls slug: create-and-track-risk-controls sequence: 10 title: "Create and track risk controls" url: https://etiscope.com/support/guide/create-and-track-risk-controls/ video_state: draft video_duration_seconds: 138.027 video_url: https://media-etiscope.jointaction.cloud/lessons/create-and-track-risk-controls/00b2353b73c4255853af435e2895ba91d37380a520fb2e5620138f02456537c8/video.mp4 captions_url: https://media-etiscope.jointaction.cloud/lessons/create-and-track-risk-controls/00b2353b73c4255853af435e2895ba91d37380a520fb2e5620138f02456537c8/captions.vtt --- # 10. Create and track risk controls Here you'll turn the evidence sentence from Decide where to act into a risk control with an owner, a date and a status. You choose the control; Etiscope helps make sure it stays visible until it's done. **Before this lesson:** 9. Decide where to act: triage and evidence (https://etiscope.com/support/guide/decide-where-to-act/) ## What you'll be able to do The learner can create a control choosing its Type from the built-in hierarchy, link it from the assessment, move it through the status lifecycle, and read the overdue card. - [choose-control-type] Choose a control's Type from the product's built-in hierarchy of controls. - [create-and-assign-control] Create a risk control in form order, with a named responsible user and a real due date. - [link-control-to-assessment] Link a risk control to the assessment that justified it. - [track-control-status-and-overdue] Move a control through its status lifecycle and read the overdue card that tracks it. ## Video - MP4: https://media-etiscope.jointaction.cloud/lessons/create-and-track-risk-controls/00b2353b73c4255853af435e2895ba91d37380a520fb2e5620138f02456537c8/video.mp4 - Captions (WebVTT): https://media-etiscope.jointaction.cloud/lessons/create-and-track-risk-controls/00b2353b73c4255853af435e2895ba91d37380a520fb2e5620138f02456537c8/captions.vtt - YouTube (secondary): https://www.youtube.com/watch?v=wUbCl0300W8 **Chapters:** 0:00 The Type field is the hierarchy · 0:29 Create the control · 0:59 Link it to the assessment · 1:23 The status lifecycle · 1:46 Overdue — and the control's tabs ## The lesson ### The Type field is the hierarchy Etiscope has the hierarchy of controls built in. A risk control's **Type** is one of: **Eliminate**, **Substitute**, **Engineering**, **Administrative**, or **PPE** — **in that order, on purpose**. The order matters. Eliminating the hazardous movement protects everyone who ever does the task, permanently, without depending on anyone remembering anything. PPE protects the person wearing it correctly, today. Which control you choose is your organisation's own engineering and approval decision. Etiscope gives you the place to record that decision, assign it, and hold it to a date. It helps to treat the **Type** field as a prompt rather than a label. If everything on your list is typed **Administrative** or **PPE**, that tells you something about the program rather than the tasks. > **On screen** — Type: None · Eliminate · Substitute · Engineering · Administrative · PPE ### Create the control Select **Risk controls** in the sidebar, and choose **New risk control**. The form runs in order: the business unit, the work task the control addresses, the **Type**, a name that says what will actually change, the status, the due date, the responsible user, and a description. Name it for the change rather than the problem. "Raise bottom pallet layer to 400mm on Line A" tells the next reader what was agreed, whereas "Manual handling risk — Line A" only repeats what they already know. **Two fields carry the follow-through: a named responsible user, and a real due date.** Without a due date, a control never appears on the overdue card, so nothing flags it if it slips; without a responsible user, there's nobody to follow it up. ### Link it to the assessment Next, link it to the evidence. Open the assessment that justified it, go to its **Risk control** tab, and choose **Add risk control**. The picker is already locked to this assessment's work task, so you're choosing among controls that could plausibly apply — pick the control you just created. The link works in both directions, which is useful. Anyone reading the assessment sees what is being done about it, and the control lists this assessment among its evidence. > **Definition** — The button reads Add risk control, then Change risk control once linked ### The status lifecycle Status is three steps: **None**, **In Progress**, **Implemented**. When work starts, open the control, open the **Status** field and choose **In Progress**. When the change is actually in place, set it to **Implemented**. **Wait until the change is in place on the floor before you set **Implemented**.** The before-and-after comparison in [Check whether a change worked](/support/guide/check-whether-a-change-worked/) depends on it: if the status says the change is in place before it actually is, any assessment captured in between is compared against a control that wasn't there yet. > **Definition** — The Risk controls list shows when each control was started and implemented ### Overdue — and the control's tabs On **Home**, the **Overdue Risk Controls** card lists every control that is **In Progress** and due today or earlier. **Overdue isn't a status anyone sets** — it's worked out from the date. You don't have to maintain anything for the program to see what's slipping, which is why it's worth entering a realistic due date rather than an optimistic one. Each control also carries its own record across four tabs: **Details**; **Attachments**, for the before photos, the quotes and the approval; **Stats**; and the **Assessments** it covers. **Stats** leads into Check whether a change worked — it's where the assessments on this control's work task are charted, and where an accumulating before-and-after eventually becomes visible. > **Definition** — The control's Stats tab charts every assessment sharing its work task ## Mistakes that matter - Typing everything as Administrative or PPE without considering the higher-order options. The hierarchy is in the field on purpose, and defaulting to the bottom of it can leave a program retraining people around a hazard it could have removed. - Controls with no owner and no due date. They never go overdue, so nothing ever flags them. - Marking a control Implemented before the change is in place. The before-and-after comparison in Check whether a change worked depends entirely on that date being true. ## Not covered here - Deciding what the control should be, which follows your organisation's own engineering and approval process - Checking whether the control changed anything — see lesson 11, Check whether a change worked (https://etiscope.com/support/guide/check-whether-a-change-worked/) **Next lesson:** 11. Check whether a change worked — https://etiscope.com/support/guide/check-whether-a-change-worked/