Use this after any update to the risk register, the treatment plan or the applicability statement, and before every external audit. You get two files in a new folder, ./risk-to-control-traceability-check/: a spreadsheet you can open in Excel with one row per link between a risk and a security measure, showing where each link breaks (traceability-matrix.csv), and a short report of the broken links, each with a proposed fix and the person who decides it (orphans.md). This skill drafts for a human to review and sign; this skill never marks a control effective. Fixes are proposals for the risk owners and the statement approver.

Inputs to gather

Read: the risk register, the treatment plan, the statement of applicability (and its AI or privacy extension if any), the obligations register, AI impact assessments where the scope covers AI systems, and the evidence index. Ask the reader which document is the master when they disagree, and who approves changes to each.

Step 1: normalise the identifiers

List every risk id with its treatment option (reduce, avoid, transfer, accept), inherent and residual scores and owner role. List every control id from the statement with its inclusion decision and status. If the documents use different id schemes or free text for control references ("access policy", "MFA"), map each mention to a control id and note the ambiguous ones for the owner. Traceability fails silently when references are prose.

Step 2: trace forward, from risk to control

For each risk:

Reduce: at least one control id or treatment action is named. Each named control is included in the statement. The residual score is lower than the inherent score, and the reduction is credited only to controls whose status is implemented.
Transfer: the instrument is named (insurance policy, contract clause) and the controls that manage the counterparty are included.
Avoid: the decision record and the activity that stopped are named.
Accept: an acceptance record exists, signed by the owner role, within the acceptance threshold or with a leadership decision. The controls its residual score assumes are included and implemented, and no finding elsewhere in the matrix breaks one of its conditions.