Skip to main content

​
Overview

The Parent & Child feature lets you create hierarchical relationships between items in your framework. A parent control can have multiple child controls beneath it, and the same applies to risks. This mirrors how organisations typically structure their frameworks — a high-level group control that breaks down into specific operational controls performed by different teams or entities.

​
When to use it

Use parent-child relationships when:
  • A group-level control is implemented differently across entities or business units, and each entity has its own version
  • A strategic risk breaks down into more specific operational risks that are owned by different teams
  • You want to roll up RAG ratings from children to give the parent an aggregated view of effectiveness

​
Setting it up

​
Configuring parent-child in Administration

Before you can create hierarchies, the feature needs to be enabled and configured.
  1. Go to Administration > Configuration
  2. Select the relevant tab (e.g., Controls for control hierarchies)
  3. Ensure the parent-child relationship option is enabled

​
Creating a parent-child relationship

​
For Controls

  1. Open the parent control’s Control Card
  2. In the Basic Information section, child controls appear as coloured cards beneath the instructions
  3. When creating a new control, you can assign it to a parent during the setup wizard
  4. Use the Filter Children buttons (Red, Amber, Green, TBC, N/A) on the parent card to filter child controls by their RAG status

​
For Risks

  1. Open the parent risk’s Risk Card
  2. Child risks can be linked from the risk’s relational information
  3. The parent risk’s scoring can reflect the aggregated position of its children

​
How it works in practice

​
Viewing the hierarchy

On a parent’s card, child items appear as coloured tiles showing:
  • The child’s name and reference number
  • The child’s owner
  • The child’s entity
  • A RAG indicator showing the child’s current Design and Operational effectiveness

​
Filtering children

The parent card includes filter buttons to narrow which children are displayed:
FilterShows
RedChildren with a Red RAG rating — need immediate attention
AmberChildren rated Amber — at risk
GreenChildren operating effectively
TBCChildren not yet assessed
N/AChildren marked as not applicable

​
Impact on reporting

​
Tips & Tricks

Keep your hierarchy to two levels (parent and child). Going deeper adds complexity without much benefit — if you need a third level, consider whether the parent is too broadly defined.
Use the Filter Children buttons on the parent card to quickly spot which entities or teams are underperforming. Red and Amber children are where your attention should go first.
Deleting a parent does not delete its children — they become standalone items. Make sure to reassign or review orphaned children after removing a parent.
Parent-child relationships are separate from the risk-control linkage. A child control still needs to be linked to its relevant risks independently — it does not inherit the parent’s risk associations.