Risk & Control Statement Writing
Most risk registers and control statements fail their first real audit.
Not because the program is weak. Because the language is wrong.
"We have multi-factor authentication enabled" is not a control statement. It is an assertion. An auditor reading it has no idea what is in scope, what is excluded, who owns it, how it is tested, or how it maps to a framework. So they mark it incomplete and ask for clarification, which delays your audit by weeks.
In this two-hour paid build session, you will write risk statements and control statements that survive auditor scrutiny. We will work through the exact language patterns that hold up across SOC 2 Type II, ISO 27001 Annex A, NIST CSF 2.0, and NIST AI RMF for AI-native companies.
What you will build:
- A risk statement template that names the threat, the asset, the impact, and the likelihood in audit-ready language
- A control statement template that defines the control, the scope, the owner, the testing cadence, and the framework mapping
- A small library of starter controls covering the most common audit findings (access management, change management, vendor risk, AI model governance)
- A framework crosswalk so each control statement satisfies multiple frameworks simultaneously
What we cover:
- The four parts of a real risk statement, and why most internal versions miss two of them
- The seven parts of a real control statement (what most templates leave out)
- How to write AI-specific control statements that auditors will accept in 2026
- The exact phrasings that pass audit and the ones that fail
- How to defend your control statement when an auditor pushes back
Who it is for: GRC managers, audit prep teams, fractional security leaders, AI startup security leads, anyone writing or reviewing control statements before a SOC 2 Type II, ISO 27001, or NIST AI RMF assessment.
You will leave with: A working risk and control statement library you can drop into your GRC platform or evidence binder immediately, plus the option to book a 30-minute consultation with me.
Hosted by Meenu Chadha, founder of Cyber Advisory and fractional vCISO. 13+ years in cybersecurity GRC, including at JPMorgan Chase, EY, S&P Ratings, MUFG, and Cantor Fitzgerald.