On 31st July 2023, we made some changes to the standardised control framework within Risk Ledger.
We do this bi-annually (every six months) so that the framework stays relevant, useful and practical for all users of the Risk Ledger platform.
All changes have been handled automatically within the platform and marked clearly with a full audit history kept within your activity feed.
This page gives you a summary of the changes that have been implemented.
As a client, what do you need to do?
There is nothing you need to do immediately. You can continue using Risk Ledger in exactly the same way as before. You may wish to do the following:
Define your policy requirements for the new controls added,
Engage with your suppliers who haven't yet answered the new control questions. Suppliers will be required to answer the new control questions during their six-monthly re-assessment. If you’d like them to provide answers before this date, you will need to prompt them by sending a discussion.
Initially, you may notice a very small increase in compliance scores for your suppliers. This is because the new controls will default to 'Not required' in your policies until you choose otherwise.
What’s changing?
Greenhouse gas emissions
We have added four new questions to the Environmental, Social and Governance (ESG) domain requesting data from suppliers regarding their scope 1, scope 2 and scope 3 emissions, as defined by Greenhouse Gas (GHG) Protocol standards. These questions are nested so that suppliers who are not in a position to provide emissions data will only see one additional question.
We have added these questions as more and more organisations are struggling to gather the data they need to accurately report emissions as part of their Carbon Reduction Plan.
Our focus remains on Information Security.
Small changes
There are a couple of other small changes we’ve made to update and clarify the wording of controls. These updates do not affect the meaning of the controls.