How Conform fits together

Most of Conform's screens are steps in one cycle. Once you see the cycle, the screens make sense.

1. Assess

Each risk you manage is an assessment unit: for example, "Client money held in the wrong account" or "Slurry and gases on the farm". Each has an inherent risk score (how bad it is with no controls) made of impact and likelihood. You work through your units each cycle on the Assessment Activity Board. See Assessments.

2. Control

Each unit has controls: the things you do that reduce the risk. When you confirm that a control is in place and working, Conform works out the residual risk: what's left after the controls. See Risk scores: inherent and residual.

3. Test

An assessment says what you believe. Testing checks it. Each control your assessments rely on is tested on a regular schedule using a checklist. The result is a percentage, compared with pass and fail lines. See How testing works.

4. Findings

A test below the fail line raises a finding: something that needs putting right, with a severity and a fix-by date. Findings can also come from audits, regulators or incidents. See Findings.

5. Actions

The work to fix a finding is done through actions, each with an owner and a due date. See Actions.

6. Back to the assessment

Testing never quietly changes your scores. Instead it proposes changes (lower this control's effectiveness, raise this unit's likelihood) and flags the unit for its next assessment, where the assessor decides. That's what keeps the cycle honest: the next assessment starts from what testing actually proved. See The improvement loop.

Two kinds of work