We are reviewing our risk control and performance assessment methodology adopted from the banking and finance sector; and we are keen to hear from other organisations who assess controls in a similar way.
We currently assess the design first and then the performance of each control, applying a 1 (very weak) to 5 (very strong) assessment range for each element.
The 1-5 scores are supported by additional narrative (descriptors) to ensure consistency of application during the assessment; however, I would like to hear from any other organisations as to their approach and the scoring criteria / descriptors used.