KAWD — Internal risk and governance interfaces

An owner records a unique reference, title, context and internal policy reference, then assigns the domain, record owner and initial probability/impact. The score places the record in the corresponding matrix cell while keeping both dimensions visible.

A revised initial assessment requires a reason and adds a new version. The register and matrix reflect it, and a prior residual assessment requires review. The score change remains connected to a written decision.

A reviewer adds a control with a verification deadline and marks whether it is required. Verification needs a note and a manual date no later than the reading date when entered. Once at least one required control exists and all required controls are verified, the owner can record independent residual judgement and its reason.

Adding or reopening a required control invalidates the previous residual assessment while preserving its history. Re-verification alone does not revive it;a new assessment decision is required. Optional controls remain available for follow-up without automatically lowering the score.

The team assigns treatment actions with an owner and deadline, then documents completion with a note and date. This remains independent of residual judgement:completion does not change the rating, and a reasoned action reopening restores its follow-up requirement.

Internal acceptance requires a valid residual score of 9 or less, all required controls verified, at least one completed action, no open actions and an acceptance note. The record locks until reasoned reopening, preserving assessments and the earlier acceptance event. This is an internal follow-up decision without a guarantee of risk elimination.