{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"index","name":"risk","next":"/assets/agent_indexes-risk-2.fc17e9d51587fbbe.json","page":1,"pageSize":100,"records":[{"attributes":{"category":"cyber_security","domain":["Access Control & Identity Management","Data Protection & Privacy"],"inherent_rating":"high","taxonomy":["iso-27005-vulnerability","nist-800-30-threat-event","nist-privacy-risk"]},"htmlUrl":"/agents/records/risk-access-excess-privilege-cd8adadc.html","id":"risk:access-excess-privilege","title":"Excessive privilege and wrong assignment of access rights","type":"risk","url":"/assets/agent_record-risk-access-excess-privilege-cd8adadc.c154ceb8157b770a.json"},{"attributes":{"category":"cyber_security","domain":["Access Control & Identity Management","Logging, Monitoring & Detection"],"inherent_rating":"high","taxonomy":["iso-27005-threat","nist-800-30-threat-event","nist-800-30-threat-source"]},"htmlUrl":"/agents/records/risk-access-privilege-abuse-repudiation-343a8917.html","id":"risk:access-privilege-abuse-repudiation","title":"Abuse of rights, forged rights, and repudiation of actions","type":"risk","url":"/assets/agent_record-risk-access-privilege-abuse-repudiation-343a8917.5dfe55c5d06b0530.json"},{"attributes":{"category":"cyber_security","domain":["Access Control & Identity Management"],"inherent_rating":"high","taxonomy":["iso-27005-vulnerability"]},"htmlUrl":"/agents/records/risk-access-provisioning-review-gap-dc152038.html","id":"risk:access-provisioning-review-gap","title":"Weak account provisioning/de-registration and access review","type":"risk","url":"/assets/agent_record-risk-access-provisioning-review-gap-dc152038.95f8a2aeb24acc6e.json"},{"attributes":{"category":"cyber_security","domain":["Access Control & Identity Management"],"inherent_rating":"medium","taxonomy":["iso-27005-threat","nist-800-30-threat-event"]},"htmlUrl":"/agents/records/risk-access-unauthorized-use-equipment-d2082944.html","id":"risk:access-unauthorized-use-equipment","title":"Unauthorized use of equipment and unauthorized access escalation","type":"risk","url":"/assets/agent_record-risk-access-unauthorized-use-equipment-d2082944.659ef798ce61ee67.json"},{"attributes":{"category":"cyber_security","domain":["Access Control & Identity Management","Network & Communications Security"],"inherent_rating":"high","taxonomy":["iso-27005-vulnerability","nist-800-30-threat-event"]},"htmlUrl":"/agents/records/risk-access-weak-authentication-4e35bdb2.html","id":"risk:access-weak-authentication","title":"Weak authentication and password management","type":"risk","url":"/assets/agent_record-risk-access-weak-authentication-4e35bdb2.331f8d7ddbb6bd4e.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Governance, Policy & Oversight","Compliance, Audit & Assurance"],"inherent_rating":"high","taxonomy":["nist-ai-rmf-risk","iso-23894-ai-risk"]},"htmlUrl":"/agents/records/risk-ai-accountability-liability-193b3f72.html","id":"risk:ai-accountability-liability","title":"AI accountability gaps and organizational liability","type":"risk","url":"/assets/agent_record-risk-ai-accountability-liability-193b3f72.db94603754a465dc.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Secure Development (SDLC) & Application Security","Vulnerability & Patch Management"],"inherent_rating":"high","taxonomy":["nist-ai-rmf-risk","iso-23894-ai-risk"]},"htmlUrl":"/agents/records/risk-ai-adversarial-poisoning-attacks-ea7df068.html","id":"risk:ai-adversarial-poisoning-attacks","title":"Adversarial attacks, data poisoning and prompt injection","type":"risk","url":"/assets/agent_record-risk-ai-adversarial-poisoning-attacks-ea7df068.68e6c6dffe8915fb.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Access Control & Identity Management"],"inherent_rating":"high","taxonomy":["owasp-llm-top10-2025","iso-23894-ai-risk"]},"htmlUrl":"/agents/records/risk-ai-agent-unauthorized-actions-194415b8.html","id":"risk:ai-agent-unauthorized-actions","title":"Unauthorized or unsafe autonomous agent actions and tool calls","type":"risk","url":"/assets/agent_record-risk-ai-agent-unauthorized-actions-194415b8.5198dd5746cb3c61.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Data Protection & Privacy","Compliance, Audit & Assurance"],"inherent_rating":"high","taxonomy":["nist-ai-rmf-risk","iso-23894-ai-risk","nist-privacy-risk"]},"htmlUrl":"/agents/records/risk-ai-bias-discrimination-35faf209.html","id":"risk:ai-bias-discrimination","title":"Harmful AI bias and discrimination against protected groups","type":"risk","url":"/assets/agent_record-risk-ai-bias-discrimination-35faf209.7c885bc120fdd613.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance"],"inherent_rating":"high","taxonomy":["nist-ai-rmf-risk","iso-23894-ai-risk"]},"htmlUrl":"/agents/records/risk-ai-catastrophic-cyber-misuse-6bced10d.html","id":"risk:ai-catastrophic-cyber-misuse","title":"Misuse of AI systems for offensive cyber operations or catastrophic harm","type":"risk","url":"/assets/agent_record-risk-ai-catastrophic-cyber-misuse-6bced10d.bad2a3730a8b7534.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Secure Development (SDLC) & Application Security"],"inherent_rating":"medium","taxonomy":["iso-23894-ai-risk"]},"htmlUrl":"/agents/records/risk-ai-emergent-integration-risk-8490271c.html","id":"risk:ai-emergent-integration-risk","title":"Emergent behaviour and unsafe AI system integration","type":"risk","url":"/assets/agent_record-risk-ai-emergent-integration-risk-8490271c.7c427d5d71af8a3d.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Network & Communications Security"],"inherent_rating":"medium","taxonomy":["owasp-llm-top10-2025","nist-ai-rmf-risk"]},"htmlUrl":"/agents/records/risk-ai-endpoint-abuse-model-extraction-a3c97c52.html","id":"risk:ai-endpoint-abuse-model-extraction","title":"AI endpoint abuse, scraping and model extraction","type":"risk","url":"/assets/agent_record-risk-ai-endpoint-abuse-model-extraction-a3c97c52.da508bc3500c6df1.json"},{"attributes":{"category":"esg","domain":["AI Governance","Risk Assessment & Management"],"inherent_rating":"low","taxonomy":["iso-23894-ai-risk"]},"htmlUrl":"/agents/records/risk-ai-environmental-footprint-c86cf6c9.html","id":"risk:ai-environmental-footprint","title":"Environmental footprint of AI training and infrastructure","type":"risk","url":"/assets/agent_record-risk-ai-environmental-footprint-c86cf6c9.e6981d3947bdb227.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Third-Party / Supply-Chain Risk","Compliance, Audit & Assurance"],"inherent_rating":"high","taxonomy":["eu-ai-act-risk","nist-ai-rmf-risk"]},"htmlUrl":"/agents/records/risk-ai-gpai-systemic-transparency-7a746323.html","id":"risk:ai-gpai-systemic-transparency","title":"GPAI transparency, systemic-risk and synthetic-content obligations","type":"risk","url":"/assets/agent_record-risk-ai-gpai-systemic-transparency-7a746323.6e7a571abe779b08.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Data Protection & Privacy","Compliance, Audit & Assurance"],"inherent_rating":"high","taxonomy":["eu-ai-act-risk"]},"htmlUrl":"/agents/records/risk-ai-highrisk-biometrics-c23b524a.html","id":"risk:ai-highrisk-biometrics","title":"Rights harm from biometric-identification AI","type":"risk","url":"/assets/agent_record-risk-ai-highrisk-biometrics-c23b524a.782d159a831b974c.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Business Continuity & Disaster Recovery","Compliance, Audit & Assurance"],"inherent_rating":"high","taxonomy":["eu-ai-act-risk"]},"htmlUrl":"/agents/records/risk-ai-highrisk-critical-infra-a7a37365.html","id":"risk:ai-highrisk-critical-infra","title":"Public-safety harm from AI in critical infrastructure","type":"risk","url":"/assets/agent_record-risk-ai-highrisk-critical-infra-a7a37365.188d0210ccd8c746.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Compliance, Audit & Assurance"],"inherent_rating":"medium","taxonomy":["eu-ai-act-risk"]},"htmlUrl":"/agents/records/risk-ai-highrisk-education-fe20b899.html","id":"risk:ai-highrisk-education","title":"Unfair exclusion by AI in education and training","type":"risk","url":"/assets/agent_record-risk-ai-highrisk-education-fe20b899.f1a75a6efc91c599.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Human Resources / Personnel Security","Compliance, Audit & Assurance"],"inherent_rating":"high","taxonomy":["eu-ai-act-risk"]},"htmlUrl":"/agents/records/risk-ai-highrisk-employment-f50a88ef.html","id":"risk:ai-highrisk-employment","title":"Discriminatory outcomes from AI in employment","type":"risk","url":"/assets/agent_record-risk-ai-highrisk-employment-f50a88ef.1e79112974744c48.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Financial Reporting Controls (SOX)","Compliance, Audit & Assurance"],"inherent_rating":"high","taxonomy":["eu-ai-act-risk"]},"htmlUrl":"/agents/records/risk-ai-highrisk-essential-services-46de2ea9.html","id":"risk:ai-highrisk-essential-services","title":"Unlawful denial of essential services by AI","type":"risk","url":"/assets/agent_record-risk-ai-highrisk-essential-services-46de2ea9.1cc9f63b630c730a.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Governance, Policy & Oversight","Compliance, Audit & Assurance"],"inherent_rating":"high","taxonomy":["eu-ai-act-risk"]},"htmlUrl":"/agents/records/risk-ai-highrisk-justice-democracy-7f7e4bfd.html","id":"risk:ai-highrisk-justice-democracy","title":"Harm to due process and democratic integrity from AI","type":"risk","url":"/assets/agent_record-risk-ai-highrisk-justice-democracy-7f7e4bfd.c4f5a787d32ca9d0.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Data Protection & Privacy","Compliance, Audit & Assurance"],"inherent_rating":"high","taxonomy":["eu-ai-act-risk"]},"htmlUrl":"/agents/records/risk-ai-highrisk-law-enforcement-7d4537e1.html","id":"risk:ai-highrisk-law-enforcement","title":"Rights violations from AI in law enforcement","type":"risk","url":"/assets/agent_record-risk-ai-highrisk-law-enforcement-7d4537e1.56621939b56634ed.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Data Protection & Privacy","Compliance, Audit & Assurance"],"inherent_rating":"high","taxonomy":["eu-ai-act-risk"]},"htmlUrl":"/agents/records/risk-ai-highrisk-migration-border-47d2b2d8.html","id":"risk:ai-highrisk-migration-border","title":"Wrongful denial by AI in migration and border control","type":"risk","url":"/assets/agent_record-risk-ai-highrisk-migration-border-47d2b2d8.a576b5e6950fddc2.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Risk Assessment & Management"],"inherent_rating":"high","taxonomy":["nist-ai-rmf-risk","iso-23894-ai-risk"]},"htmlUrl":"/agents/records/risk-ai-inaccurate-unreliable-output-cf10c86e.html","id":"risk:ai-inaccurate-unreliable-output","title":"Inaccurate, unreliable or hallucinated AI outputs","type":"risk","url":"/assets/agent_record-risk-ai-inaccurate-unreliable-output-cf10c86e.e5b352e1d741db19.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Governance, Policy & Oversight"],"inherent_rating":"medium","taxonomy":["iso-23894-ai-risk"]},"htmlUrl":"/agents/records/risk-ai-inappropriate-task-allocation-72a18be5.html","id":"risk:ai-inappropriate-task-allocation","title":"Inappropriate human/AI task allocation and end-of-life risk","type":"risk","url":"/assets/agent_record-risk-ai-inappropriate-task-allocation-72a18be5.c080cac277213ef1.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Secure Development (SDLC) & Application Security"],"inherent_rating":"high","taxonomy":["owasp-llm-top10-2025"]},"htmlUrl":"/agents/records/risk-ai-insecure-generated-code-ec50f0f9.html","id":"risk:ai-insecure-generated-code","title":"Insecure AI-generated code and hallucinated or typosquatted dependencies","type":"risk","url":"/assets/agent_record-risk-ai-insecure-generated-code-ec50f0f9.15f7d82f2e146cde.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Governance, Policy & Oversight"],"inherent_rating":"high","taxonomy":["nist-ai-rmf-risk","iso-23894-ai-risk","eu-ai-act-risk"]},"htmlUrl":"/agents/records/risk-ai-insufficient-human-oversight-6c4f3dfa.html","id":"risk:ai-insufficient-human-oversight","title":"Insufficient human oversight and automation complacency","type":"risk","url":"/assets/agent_record-risk-ai-insufficient-human-oversight-6c4f3dfa.175ed6e53f86e774.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Governance, Policy & Oversight"],"inherent_rating":"medium","taxonomy":["nist-ai-rmf-risk","iso-23894-ai-risk","eu-ai-act-risk"]},"htmlUrl":"/agents/records/risk-ai-lack-explainability-transparency-edbd29e2.html","id":"risk:ai-lack-explainability-transparency","title":"Lack of AI explainability, documentation and disclosure","type":"risk","url":"/assets/agent_record-risk-ai-lack-explainability-transparency-edbd29e2.bab3851c45c00e9e.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Logging, Monitoring & Detection"],"inherent_rating":"high","taxonomy":["nist-ai-rmf-risk","iso-23894-ai-risk","eu-ai-act-risk"]},"htmlUrl":"/agents/records/risk-ai-model-drift-monitoring-15329f38.html","id":"risk:ai-model-drift-monitoring","title":"Model/data drift and inadequate post-deployment monitoring","type":"risk","url":"/assets/agent_record-risk-ai-model-drift-monitoring-15329f38.37fd0328a377be1e.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Business Continuity & Disaster Recovery"],"inherent_rating":"medium","taxonomy":["nist-ai-rmf-risk"]},"htmlUrl":"/agents/records/risk-ai-model-resilience-fallback-gap-85070995.html","id":"risk:ai-model-resilience-fallback-gap","title":"Insufficient AI resilience and fallback mechanisms","type":"risk","url":"/assets/agent_record-risk-ai-model-resilience-fallback-gap-85070995.b6b2ff0af2a56076.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Data Protection & Privacy"],"inherent_rating":"high","taxonomy":["iso-23894-ai-risk","eu-ai-act-risk"]},"htmlUrl":"/agents/records/risk-ai-poor-training-data-quality-95872765.html","id":"risk:ai-poor-training-data-quality","title":"Poor-quality, unrepresentative or mislabeled training data","type":"risk","url":"/assets/agent_record-risk-ai-poor-training-data-quality-95872765.edb8e2e411d5d78e.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Risk Assessment & Management"],"inherent_rating":"medium","taxonomy":["nist-ai-rmf-risk"]},"htmlUrl":"/agents/records/risk-ai-power-concentration-societal-473c979a.html","id":"risk:ai-power-concentration-societal","title":"AI power concentration and erosion of societal trust","type":"risk","url":"/assets/agent_record-risk-ai-power-concentration-societal-473c979a.8ad0af7004f690ff.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Data Protection & Privacy"],"inherent_rating":"high","taxonomy":["nist-ai-rmf-risk","nist-privacy-risk"]},"htmlUrl":"/agents/records/risk-ai-privacy-leakage-9aa8d83c.html","id":"risk:ai-privacy-leakage","title":"AI privacy leakage and re-identification","type":"risk","url":"/assets/agent_record-risk-ai-privacy-leakage-9aa8d83c.ff6b2a9cfa591fb9.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Compliance, Audit & Assurance"],"inherent_rating":"high","taxonomy":["eu-ai-act-risk"]},"htmlUrl":"/agents/records/risk-ai-prohibited-practices-daf993e5.html","id":"risk:ai-prohibited-practices","title":"Deployment of prohibited AI practices (EU AI Act Art.5)","type":"risk","url":"/assets/agent_record-risk-ai-prohibited-practices-daf993e5.a0bfc20d5b006929.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Risk Assessment & Management"],"inherent_rating":"high","taxonomy":["nist-ai-rmf-risk","iso-23894-ai-risk"]},"htmlUrl":"/agents/records/risk-ai-safety-harm-to-people-d02cb500.html","id":"risk:ai-safety-harm-to-people","title":"AI safety failures causing physical or psychological harm","type":"risk","url":"/assets/agent_record-risk-ai-safety-harm-to-people-d02cb500.c92982c948595fe0.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Data Protection & Privacy","Cryptography & Key Management"],"inherent_rating":"high","taxonomy":["owasp-llm-top10-2025","nist-ai-rmf-risk"]},"htmlUrl":"/agents/records/risk-ai-secrets-credential-leakage-abf1bf77.html","id":"risk:ai-secrets-credential-leakage","title":"Credential and secret leakage through AI inputs, outputs, logs and generated code","type":"risk","url":"/assets/agent_record-risk-ai-secrets-credential-leakage-abf1bf77.102567b687c1fc7d.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Third-Party / Supply-Chain Risk","Secure Development (SDLC) & Application Security"],"inherent_rating":"high","taxonomy":["nist-ai-rmf-risk","iso-23894-ai-risk","eu-ai-act-risk"]},"htmlUrl":"/agents/records/risk-ai-supply-chain-concentration-9f791f54.html","id":"risk:ai-supply-chain-concentration","title":"AI supply-chain compromise and provider concentration","type":"risk","url":"/assets/agent_record-risk-ai-supply-chain-concentration-9f791f54.263d1eb3adc4c1e2.json"},{"attributes":{"category":"operational","domain":["Asset Management & Inventory","Business Continuity & Disaster Recovery"],"inherent_rating":"medium","taxonomy":["iso-27005-vulnerability","nist-800-30-threat-event"]},"htmlUrl":"/agents/records/risk-asset-aging-hardware-no-replacement-f3ed1c2c.html","id":"risk:asset-aging-hardware-no-replacement","title":"Aging hardware with no periodic replacement scheme","type":"risk","url":"/assets/agent_record-risk-asset-aging-hardware-no-replacement-f3ed1c2c.94a313de93b5a4ec.json"},{"attributes":{"category":"operational","domain":["Asset Management & Inventory","Data Protection & Privacy"],"inherent_rating":"medium","taxonomy":["iso-27005-vulnerability"]},"htmlUrl":"/agents/records/risk-asset-inventory-gap-e18c7e73.html","id":"risk:asset-inventory-gap","title":"Incomplete asset inventory and classification","type":"risk","url":"/assets/agent_record-risk-asset-inventory-gap-e18c7e73.eff694953485c2c6.json"},{"attributes":{"category":"cyber_security","domain":["Asset Management & Inventory","Secure Configuration & Change Management"],"inherent_rating":"medium","taxonomy":["iso-27005-vulnerability","iso-27005-threat"]},"htmlUrl":"/agents/records/risk-asset-uncontrolled-copying-removable-media-4a9604c7.html","id":"risk:asset-uncontrolled-copying-removable-media","title":"Uncontrolled copying to removable media / unmanaged software installs","type":"risk","url":"/assets/agent_record-risk-asset-uncontrolled-copying-removable-media-4a9604c7.712035880d24449f.json"},{"attributes":{"category":"cyber_security","domain":["Awareness & Training","Human Resources / Personnel Security"],"inherent_rating":"high","taxonomy":["iso-27005-vulnerability","nist-privacy-risk"]},"htmlUrl":"/agents/records/risk-aware-insufficient-training-7cb09d2f.html","id":"risk:aware-insufficient-training","title":"Inadequate security awareness and training","type":"risk","url":"/assets/agent_record-risk-aware-insufficient-training-7cb09d2f.0b8b5df9ddbc3039.json"},{"attributes":{"category":"cyber_security","domain":["Awareness & Training","Data Protection & Privacy"],"inherent_rating":"medium","taxonomy":["iso-27005-vulnerability"]},"htmlUrl":"/agents/records/risk-aware-no-acceptable-use-policy-e874ca5c.html","id":"risk:aware-no-acceptable-use-policy","title":"No acceptable-use policy for messaging and telecoms","type":"risk","url":"/assets/agent_record-risk-aware-no-acceptable-use-policy-e874ca5c.3ed302d2568a687a.json"},{"attributes":{"category":"cyber_security","domain":["Awareness & Training","Access Control & Identity Management"],"inherent_rating":"critical","taxonomy":["nist-800-30-threat-event","basel-operational-risk"]},"htmlUrl":"/agents/records/risk-aware-phishing-social-engineering-bb9b7bd6.html","id":"risk:aware-phishing-social-engineering","title":"Phishing, spear-phishing and social engineering","type":"risk","url":"/assets/agent_record-risk-aware-phishing-social-engineering-bb9b7bd6.04cc1eb066c178e1.json"},{"attributes":{"category":"cyber_security","domain":["Awareness & Training","Human Resources / Personnel Security"],"inherent_rating":"medium","taxonomy":["iso-27005-vulnerability","nist-privacy-risk"]},"htmlUrl":"/agents/records/risk-aware-role-based-training-gap-3e2ca2c3.html","id":"risk:aware-role-based-training-gap","title":"Missing role-based and ongoing security/privacy training","type":"risk","url":"/assets/agent_record-risk-aware-role-based-training-gap-3e2ca2c3.16d6246efc955b0b.json"},{"attributes":{"category":"operational","domain":["Awareness & Training","Data Protection & Privacy","Logging, Monitoring & Detection"],"inherent_rating":"high","taxonomy":["iso-27005-threat","nist-800-30-threat-event","nist-800-30-threat-source","iso-27005-vulnerability"]},"htmlUrl":"/agents/records/risk-aware-user-error-mishandling-149a1d3b.html","id":"risk:aware-user-error-mishandling","title":"User error and mishandling of sensitive information","type":"risk","url":"/assets/agent_record-risk-aware-user-error-mishandling-149a1d3b.111c3fa544df22a0.json"},{"attributes":{"category":"business_continuity","domain":["Business Continuity & Disaster Recovery","Logging, Monitoring & Detection"],"inherent_rating":"high","taxonomy":["coso-erm-risk","basel-operational-risk"]},"htmlUrl":"/agents/records/risk-bcdr-it-resilience-outage-18dfc108.html","id":"risk:bcdr-it-resilience-outage","title":"IT resilience failure — unplanned outage, data loss, slow recovery","type":"risk","url":"/assets/agent_record-risk-bcdr-it-resilience-outage-18dfc108.676c731632e2a885.json"},{"attributes":{"category":"business_continuity","domain":["Business Continuity & Disaster Recovery","Risk Assessment & Management"],"inherent_rating":"high","taxonomy":["enterprise-risk","coso-erm-risk","iso-27005-vulnerability"]},"htmlUrl":"/agents/records/risk-bcdr-no-tested-continuity-plan-d4d9e7a9.html","id":"risk:bcdr-no-tested-continuity-plan","title":"Absent or untested business continuity / disaster recovery plan","type":"risk","url":"/assets/agent_record-risk-bcdr-no-tested-continuity-plan-d4d9e7a9.2e628816044d5241.json"},{"attributes":{"category":"business_continuity","domain":["Business Continuity & Disaster Recovery","Network & Communications Security"],"inherent_rating":"high","taxonomy":["enterprise-risk","iso-27005-vulnerability","nist-800-30-threat-event"]},"htmlUrl":"/agents/records/risk-bcdr-single-point-concentration-91008453.html","id":"risk:bcdr-single-point-concentration","title":"Single-site / single-region / single-supply concentration","type":"risk","url":"/assets/agent_record-risk-bcdr-single-point-concentration-91008453.29ef0448071a935e.json"},{"attributes":{"category":"compliance_regulatory","domain":["Compliance, Audit & Assurance","Risk Assessment & Management"],"inherent_rating":"medium","taxonomy":["basel-operational-risk"]},"htmlUrl":"/agents/records/risk-compliance-client-suitability-fiduciary-2212ad74.html","id":"risk:compliance-client-suitability-fiduciary","title":"Client suitability, disclosure and fiduciary breaches","type":"risk","url":"/assets/agent_record-risk-compliance-client-suitability-fiduciary-2212ad74.f407e637f9925b75.json"},{"attributes":{"category":"compliance_regulatory","domain":["Compliance, Audit & Assurance","Risk Assessment & Management"],"inherent_rating":"medium","taxonomy":["enterprise-risk"]},"htmlUrl":"/agents/records/risk-compliance-environmental-regulatory-5adf55ce.html","id":"risk:compliance-environmental-regulatory","title":"Environmental regulatory non-compliance","type":"risk","url":"/assets/agent_record-risk-compliance-environmental-regulatory-5adf55ce.fe533661f93a8edc.json"},{"attributes":{"category":"compliance_regulatory","domain":["Compliance, Audit & Assurance","Governance, Policy & Oversight"],"inherent_rating":"high","taxonomy":["basel-operational-risk"]},"htmlUrl":"/agents/records/risk-compliance-improper-market-practices-9c55cfe9.html","id":"risk:compliance-improper-market-practices","title":"Improper business or market practices","type":"risk","url":"/assets/agent_record-risk-compliance-improper-market-practices-9c55cfe9.1a777f734f0a201c.json"},{"attributes":{"category":"compliance_regulatory","domain":["Compliance, Audit & Assurance","Asset Management & Inventory"],"inherent_rating":"medium","taxonomy":["enterprise-risk","coso-erm-risk"]},"htmlUrl":"/agents/records/risk-compliance-ip-infringement-337b44a1.html","id":"risk:compliance-ip-infringement","title":"Intellectual property loss or infringement","type":"risk","url":"/assets/agent_record-risk-compliance-ip-infringement-337b44a1.ffa278d5134c28ca.json"},{"attributes":{"category":"compliance_regulatory","domain":["Compliance, Audit & Assurance","Governance, Policy & Oversight"],"inherent_rating":"high","taxonomy":["enterprise-risk","coso-erm-risk"]},"htmlUrl":"/agents/records/risk-compliance-litigation-enforcement-25e7935d.html","id":"risk:compliance-litigation-enforcement","title":"Litigation, investigation and enforcement exposure","type":"risk","url":"/assets/agent_record-risk-compliance-litigation-enforcement-25e7935d.963b6cccfc52b94e.json"},{"attributes":{"category":"compliance_regulatory","domain":["Compliance, Audit & Assurance","Governance, Policy & Oversight"],"inherent_rating":"medium","taxonomy":["iso-27005-vulnerability","coso-erm-risk"]},"htmlUrl":"/agents/records/risk-compliance-no-independent-audit-9e1acf0f.html","id":"risk:compliance-no-independent-audit","title":"Lack of independent audit and compliance review","type":"risk","url":"/assets/agent_record-risk-compliance-no-independent-audit-9e1acf0f.8a44783c74772a6f.json"},{"attributes":{"category":"compliance_regulatory","domain":["Compliance, Audit & Assurance","Risk Assessment & Management"],"inherent_rating":"medium","taxonomy":["coso-erm-risk"]},"htmlUrl":"/agents/records/risk-compliance-regulatory-policy-change-9429f25b.html","id":"risk:compliance-regulatory-policy-change","title":"Adverse regulatory or policy change","type":"risk","url":"/assets/agent_record-risk-compliance-regulatory-policy-change-9429f25b.c922efc13b75a562.json"},{"attributes":{"category":"compliance_regulatory","domain":["Compliance, Audit & Assurance","Risk Assessment & Management"],"inherent_rating":"high","taxonomy":["enterprise-risk","coso-erm-risk"]},"htmlUrl":"/agents/records/risk-compliance-sector-regulatory-breach-5eb29698.html","id":"risk:compliance-sector-regulatory-breach","title":"Sector regulatory non-compliance (financial, healthcare, trade)","type":"risk","url":"/assets/agent_record-risk-compliance-sector-regulatory-breach-5eb29698.f5bea48f81eeab11.json"},{"attributes":{"category":"compliance_regulatory","domain":["Risk Assessment & Management","Compliance, Audit & Assurance"],"inherent_rating":"medium","taxonomy":["basel-operational-risk"]},"htmlUrl":"/agents/records/risk-compliance-selection-exposure-limits-8640d0d6.html","id":"risk:compliance-selection-exposure-limits","title":"Client selection, sponsorship and exposure-limit breaches","type":"risk","url":"/assets/agent_record-risk-compliance-selection-exposure-limits-8640d0d6.32cff40ad6fef737.json"},{"attributes":{"category":"cyber_security","domain":["Secure Configuration & Change Management","Network & Communications Security","Vulnerability & Patch Management"],"inherent_rating":"high","taxonomy":["nist-800-30-threat-event"]},"htmlUrl":"/agents/records/risk-config-internet-exposed-misconfig-61b3613a.html","id":"risk:config-internet-exposed-misconfig","title":"Internet-exposed or misconfigured systems","type":"risk","url":"/assets/agent_record-risk-config-internet-exposed-misconfig-61b3613a.784e8a1bdf681744.json"},{"attributes":{"category":"cyber_security","domain":["Secure Configuration & Change Management","Vulnerability & Patch Management"],"inherent_rating":"high","taxonomy":["iso-27005-vulnerability","nist-800-30-threat-event"]},"htmlUrl":"/agents/records/risk-config-poor-baseline-drift-2dd66324.html","id":"risk:config-poor-baseline-drift","title":"Poor configuration management and insecure baseline drift","type":"risk","url":"/assets/agent_record-risk-config-poor-baseline-drift-2dd66324.de11f6b9169c61ac.json"},{"attributes":{"category":"cyber_security","domain":["Secure Configuration & Change Management","Secure Development (SDLC) & Application Security"],"inherent_rating":"medium","taxonomy":["iso-27005-vulnerability"]},"htmlUrl":"/agents/records/risk-config-weak-change-control-e7d90eaf.html","id":"risk:config-weak-change-control","title":"Absent or weak change-control procedures","type":"risk","url":"/assets/agent_record-risk-config-weak-change-control-e7d90eaf.0118c76865b2782b.json"},{"attributes":{"category":"cyber_security","domain":["Cryptography & Key Management","Network & Communications Security"],"inherent_rating":"high","taxonomy":["iso-27005-vulnerability"]},"htmlUrl":"/agents/records/risk-crypto-cleartext-credential-transfer-b88065a1.html","id":"risk:crypto-cleartext-credential-transfer","title":"Credentials and sensitive data transmitted in clear text","type":"risk","url":"/assets/agent_record-risk-crypto-cleartext-credential-transfer-b88065a1.a9caa8149d5dd221.json"},{"attributes":{"category":"cyber_security","domain":["Cryptography & Key Management","Network & Communications Security"],"inherent_rating":"high","taxonomy":["nist-800-30-threat-event"]},"htmlUrl":"/agents/records/risk-crypto-counterfeit-certificates-d9dcc5c5.html","id":"risk:crypto-counterfeit-certificates","title":"Compromised or counterfeit certificates / certificate authority","type":"risk","url":"/assets/agent_record-risk-crypto-counterfeit-certificates-d9dcc5c5.8f0926d32cdc4988.json"},{"attributes":{"category":"cyber_security","domain":["Cryptography & Key Management","Data Protection & Privacy","Network & Communications Security"],"inherent_rating":"high","taxonomy":["iso-27005-vulnerability","nist-800-30-threat-event","nist-privacy-risk"]},"htmlUrl":"/agents/records/risk-crypto-weak-or-absent-encryption-2fe7d24e.html","id":"risk:crypto-weak-or-absent-encryption","title":"Weak or absent encryption and key management","type":"risk","url":"/assets/agent_record-risk-crypto-weak-or-absent-encryption-2fe7d24e.22e603984ef2659e.json"},{"attributes":{"category":"cyber_security","domain":["Risk Assessment & Management","Logging, Monitoring & Detection"],"inherent_rating":"high","taxonomy":["nist-800-30-threat-source"]},"htmlUrl":"/agents/records/risk-cyber-adversary-threat-sources-fa9e3003.html","id":"risk:cyber-adversary-threat-sources","title":"Attacks by capable, motivated threat actors","type":"risk","url":"/assets/agent_record-risk-cyber-adversary-threat-sources-fa9e3003.8ace32770a775a42.json"},{"attributes":{"category":"cyber_security","domain":["Logging, Monitoring & Detection","Incident Management & Response","Network & Communications Security"],"inherent_rating":"high","taxonomy":["nist-800-30-threat-event"]},"htmlUrl":"/agents/records/risk-cyber-coordinated-campaign-b5879769.html","id":"risk:cyber-coordinated-campaign","title":"Coordinated multi-stage / APT campaigns","type":"risk","url":"/assets/agent_record-risk-cyber-coordinated-campaign-b5879769.6d44447e8f95c57c.json"},{"attributes":{"category":"cyber_security","domain":["Logging, Monitoring & Detection","Network & Communications Security"],"inherent_rating":"medium","taxonomy":["nist-800-30-threat-event"]},"htmlUrl":"/agents/records/risk-cyber-reconnaissance-3a7a6c33.html","id":"risk:cyber-reconnaissance","title":"Adversary reconnaissance and information gathering","type":"risk","url":"/assets/agent_record-risk-cyber-reconnaissance-3a7a6c33.80439a2b482acb99.json"},{"attributes":{"category":"privacy","domain":["Data Protection & Privacy","Incident Management & Response"],"inherent_rating":"high","taxonomy":["iso-27005-threat","nist-800-30-threat-event","nist-privacy-risk"]},"htmlUrl":"/agents/records/risk-data-breach-unauthorized-disclosure-3b1c296c.html","id":"risk:data-breach-unauthorized-disclosure","title":"Unauthorized disclosure / breach of sensitive information","type":"risk","url":"/assets/agent_record-risk-data-breach-unauthorized-disclosure-3b1c296c.8431603df36984c8.json"},{"attributes":{"category":"cyber_security","domain":["Data Protection & Privacy","Secure Development (SDLC) & Application Security"],"inherent_rating":"high","taxonomy":["iso-27005-threat","nist-800-30-threat-event"]},"htmlUrl":"/agents/records/risk-data-corruption-integrity-loss-e771738a.html","id":"risk:data-corruption-integrity-loss","title":"Corruption or integrity loss of critical data","type":"risk","url":"/assets/agent_record-risk-data-corruption-integrity-loss-e771738a.745d8cb348a7d703.json"},{"attributes":{"category":"privacy","domain":["Data Protection & Privacy"],"inherent_rating":"high","taxonomy":["nist-privacy-risk"]},"htmlUrl":"/agents/records/risk-data-excessive-collection-purpose-creep-4a691595.html","id":"risk:data-excessive-collection-purpose-creep","title":"Excessive collection, purpose creep and secondary use","type":"risk","url":"/assets/agent_record-risk-data-excessive-collection-purpose-creep-4a691595.e19f1e2bcd3171d8.json"},{"attributes":{"category":"cyber_security","domain":["Data Protection & Privacy","Network & Communications Security","Logging, Monitoring & Detection"],"inherent_rating":"critical","taxonomy":["nist-800-30-threat-event","nist-800-30-threat-source","basel-operational-risk","coso-erm-risk"]},"htmlUrl":"/agents/records/risk-data-exfiltration-espionage-74803ebc.html","id":"risk:data-exfiltration-espionage","title":"Data exfiltration and theft of information by attackers","type":"risk","url":"/assets/agent_record-risk-data-exfiltration-espionage-74803ebc.a1ef3e79ab006192.json"},{"attributes":{"category":"privacy","domain":["Data Protection & Privacy","Asset Management & Inventory"],"inherent_rating":"medium","taxonomy":["nist-privacy-risk"]},"htmlUrl":"/agents/records/risk-data-inventory-flows-unmapped-fd7746f8.html","id":"risk:data-inventory-flows-unmapped","title":"Undocumented data inventory and unmapped data flows","type":"risk","url":"/assets/agent_record-risk-data-inventory-flows-unmapped-fd7746f8.a02a8c6342331cd0.json"},{"attributes":{"category":"privacy","domain":["Data Protection & Privacy","AI Governance"],"inherent_rating":"medium","taxonomy":["nist-privacy-risk"]},"htmlUrl":"/agents/records/risk-data-privacy-harms-to-individuals-510e65af.html","id":"risk:data-privacy-harms-to-individuals","title":"Privacy harms: distortion, stigmatization, unwarranted restriction","type":"risk","url":"/assets/agent_record-risk-data-privacy-harms-to-individuals-510e65af.a2f2b4ad6db96f69.json"},{"attributes":{"category":"privacy","domain":["Data Protection & Privacy","Compliance, Audit & Assurance"],"inherent_rating":"high","taxonomy":["nist-privacy-risk","enterprise-risk"]},"htmlUrl":"/agents/records/risk-data-privacy-program-noncompliance-ec6178fa.html","id":"risk:data-privacy-program-noncompliance","title":"Privacy-program non-compliance (GDPR, CCPA, state laws)","type":"risk","url":"/assets/agent_record-risk-data-privacy-program-noncompliance-ec6178fa.f8a5498a8697316f.json"},{"attributes":{"category":"privacy","domain":["Data Protection & Privacy"],"inherent_rating":"medium","taxonomy":["nist-privacy-risk"]},"htmlUrl":"/agents/records/risk-data-reidentification-inference-d4b31f45.html","id":"risk:data-reidentification-inference","title":"Re-identification and unanticipated revelation from data","type":"risk","url":"/assets/agent_record-risk-data-reidentification-inference-d4b31f45.feabe05a491c6f3f.json"},{"attributes":{"category":"privacy","domain":["Data Protection & Privacy","Asset Management & Inventory"],"inherent_rating":"medium","taxonomy":["iso-27005-threat","iso-27005-vulnerability","nist-800-30-threat-event"]},"htmlUrl":"/agents/records/risk-data-residual-media-disposal-92de3d1d.html","id":"risk:data-residual-media-disposal","title":"Residual data on improperly disposed or re-used media","type":"risk","url":"/assets/agent_record-risk-data-residual-media-disposal-92de3d1d.cb159efe6720ab90.json"},{"attributes":{"category":"privacy","domain":["Data Protection & Privacy","Compliance, Audit & Assurance"],"inherent_rating":"medium","taxonomy":["nist-privacy-risk","enterprise-risk"]},"htmlUrl":"/agents/records/risk-data-retention-noncompliance-ec7b8dbc.html","id":"risk:data-retention-noncompliance","title":"Unlawful retention or premature deletion of records","type":"risk","url":"/assets/agent_record-risk-data-retention-noncompliance-ec7b8dbc.36421190fb2586f6.json"},{"attributes":{"category":"privacy","domain":["Data Protection & Privacy"],"inherent_rating":"medium","taxonomy":["nist-privacy-risk","nist-ai-rmf-risk"]},"htmlUrl":"/agents/records/risk-data-surveillance-appropriation-18ad67e7.html","id":"risk:data-surveillance-appropriation","title":"Excessive surveillance, appropriation and induced disclosure","type":"risk","url":"/assets/agent_record-risk-data-surveillance-appropriation-18ad67e7.571fc2bbf276fe19.json"},{"attributes":{"category":"privacy","domain":["Data Protection & Privacy","Awareness & Training"],"inherent_rating":"medium","taxonomy":["nist-privacy-risk"]},"htmlUrl":"/agents/records/risk-data-transparency-notice-dark-patterns-9326fdf0.html","id":"risk:data-transparency-notice-dark-patterns","title":"Inadequate transparency, notice and deceptive privacy communications","type":"risk","url":"/assets/agent_record-risk-data-transparency-notice-dark-patterns-9326fdf0.86b6f27e81ff4310.json"},{"attributes":{"category":"esg","domain":["Business Continuity & Disaster Recovery","Physical & Environmental Security","Third-Party / Supply-Chain Risk"],"inherent_rating":"high","taxonomy":["enterprise-risk","coso-erm-risk"]},"htmlUrl":"/agents/records/risk-esg-climate-physical-210261c0.html","id":"risk:esg-climate-physical","title":"Physical climate risk to facilities and supply chains","type":"risk","url":"/assets/agent_record-risk-esg-climate-physical-210261c0.1a631bae7015af63.json"},{"attributes":{"category":"esg","domain":["Risk Assessment & Management","Governance, Policy & Oversight"],"inherent_rating":"medium","taxonomy":["enterprise-risk","coso-erm-risk"]},"htmlUrl":"/agents/records/risk-esg-climate-transition-35e73915.html","id":"risk:esg-climate-transition","title":"Climate transition risk — carbon pricing and stranded assets","type":"risk","url":"/assets/agent_record-risk-esg-climate-transition-35e73915.f51e44df8585499f.json"},{"attributes":{"category":"esg","domain":["Compliance, Audit & Assurance","Governance, Policy & Oversight"],"inherent_rating":"medium","taxonomy":["enterprise-risk","coso-erm-risk"]},"htmlUrl":"/agents/records/risk-esg-greenwashing-disclosure-be236248.html","id":"risk:esg-greenwashing-disclosure","title":"ESG disclosure gaps and greenwashing","type":"risk","url":"/assets/agent_record-risk-esg-greenwashing-disclosure-be236248.b22c2dfb8e5027f5.json"},{"attributes":{"category":"esg","domain":["Third-Party / Supply-Chain Risk","Human Resources / Personnel Security","Compliance, Audit & Assurance"],"inherent_rating":"medium","taxonomy":["coso-erm-risk"]},"htmlUrl":"/agents/records/risk-esg-social-human-rights-1dbeca21.html","id":"risk:esg-social-human-rights","title":"Social and human-rights failures in operations and supply chain","type":"risk","url":"/assets/agent_record-risk-esg-social-human-rights-1dbeca21.962e236206a0b286.json"},{"attributes":{"category":"financial_reporting","domain":["Financial Reporting Controls (SOX)"],"inherent_rating":"medium","taxonomy":["sox-rmm-assertion"]},"htmlUrl":"/agents/records/risk-fin-accuracy-measurement-errors-fd727255.html","id":"risk:fin-accuracy-measurement-errors","title":"Measurement and calculation errors (accuracy)","type":"risk","url":"/assets/agent_record-risk-fin-accuracy-measurement-errors-fd727255.4628396b1fcc6cf6.json"},{"attributes":{"category":"financial_reporting","domain":["Financial Reporting Controls (SOX)"],"inherent_rating":"high","taxonomy":["sox-rmm-assertion"]},"htmlUrl":"/agents/records/risk-fin-completeness-understatement-4b9388d1.html","id":"risk:fin-completeness-understatement","title":"Understatement of liabilities/expenses (completeness)","type":"risk","url":"/assets/agent_record-risk-fin-completeness-understatement-4b9388d1.ae76e179265f879b.json"},{"attributes":{"category":"compliance_regulatory","domain":["Compliance, Audit & Assurance","Risk Assessment & Management","Governance, Policy & Oversight"],"inherent_rating":"high","taxonomy":["enterprise-risk","basel-operational-risk","coso-erm-risk"]},"htmlUrl":"/agents/records/risk-fin-crime-aml-sanctions-80b15201.html","id":"risk:fin-crime-aml-sanctions","title":"Money laundering, sanctions and financial-crime program failures","type":"risk","url":"/assets/agent_record-risk-fin-crime-aml-sanctions-80b15201.3441cdfac714d353.json"},{"attributes":{"category":"financial_reporting","domain":["Financial Reporting Controls (SOX)"],"inherent_rating":"medium","taxonomy":["sox-rmm-assertion"]},"htmlUrl":"/agents/records/risk-fin-cutoff-period-errors-180e8bcf.html","id":"risk:fin-cutoff-period-errors","title":"Period cut-off errors","type":"risk","url":"/assets/agent_record-risk-fin-cutoff-period-errors-180e8bcf.3601f2d8b43b607f.json"},{"attributes":{"category":"financial_reporting","domain":["Financial Reporting Controls (SOX)","Data Protection & Privacy","Compliance, Audit & Assurance"],"inherent_rating":"high","taxonomy":["enterprise-risk","coso-erm-risk"]},"htmlUrl":"/agents/records/risk-fin-data-quality-reporting-integrity-276baaa6.html","id":"risk:fin-data-quality-reporting-integrity","title":"Data-quality and IPE integrity failures in reporting","type":"risk","url":"/assets/agent_record-risk-fin-data-quality-reporting-integrity-276baaa6.94785b86a662b514.json"},{"attributes":{"category":"financial_reporting","domain":["Financial Reporting Controls (SOX)"],"inherent_rating":"high","taxonomy":["sox-rmm-assertion"]},"htmlUrl":"/agents/records/risk-fin-existence-overstatement-0e009631.html","id":"risk:fin-existence-overstatement","title":"Overstatement of assets/revenue (existence & occurrence)","type":"risk","url":"/assets/agent_record-risk-fin-existence-overstatement-0e009631.e106ea3635dc71b6.json"},{"attributes":{"category":"financial_reporting","domain":["Financial Reporting Controls (SOX)","Compliance, Audit & Assurance"],"inherent_rating":"high","taxonomy":["sox-rmm-assertion","coso-erm-risk"]},"htmlUrl":"/agents/records/risk-fin-financial-statement-fraud-1dd35d5a.html","id":"risk:fin-financial-statement-fraud","title":"Financial-statement fraud and management override","type":"risk","url":"/assets/agent_record-risk-fin-financial-statement-fraud-1dd35d5a.0b3cf75ecebe244f.json"},{"attributes":{"category":"financial_reporting","domain":["Financial Reporting Controls (SOX)","Compliance, Audit & Assurance","Governance, Policy & Oversight"],"inherent_rating":"critical","taxonomy":["enterprise-risk","coso-erm-risk","sox-rmm-assertion"]},"htmlUrl":"/agents/records/risk-fin-icfr-material-weakness-cdd66323.html","id":"risk:fin-icfr-material-weakness","title":"Ineffective ICFR / undisclosed material weakness","type":"risk","url":"/assets/agent_record-risk-fin-icfr-material-weakness-cdd66323.c752785baa39846a.json"},{"attributes":{"category":"financial_reporting","domain":["Financial Reporting Controls (SOX)","Logging, Monitoring & Detection"],"inherent_rating":"high","taxonomy":["sox-rmm-assertion"]},"htmlUrl":"/agents/records/risk-fin-journal-entry-management-override-b0c0ed68.html","id":"risk:fin-journal-entry-management-override","title":"Manual journal entries and management-override risk","type":"risk","url":"/assets/agent_record-risk-fin-journal-entry-management-override-b0c0ed68.9d5e8f3457283361.json"},{"attributes":{"category":"financial_reporting","domain":["Financial Reporting Controls (SOX)","Compliance, Audit & Assurance"],"inherent_rating":"medium","taxonomy":["sox-rmm-assertion"]},"htmlUrl":"/agents/records/risk-fin-presentation-disclosure-5c00107e.html","id":"risk:fin-presentation-disclosure","title":"Presentation and disclosure deficiencies","type":"risk","url":"/assets/agent_record-risk-fin-presentation-disclosure-5c00107e.ec6c8184ad27b942.json"},{"attributes":{"category":"financial_reporting","domain":["Financial Reporting Controls (SOX)","Compliance, Audit & Assurance"],"inherent_rating":"high","taxonomy":["sox-rmm-assertion"]},"htmlUrl":"/agents/records/risk-fin-revenue-recognition-misstatement-5e181e17.html","id":"risk:fin-revenue-recognition-misstatement","title":"Revenue-recognition misstatement (fictitious, mis-timed, mis-measured)","type":"risk","url":"/assets/agent_record-risk-fin-revenue-recognition-misstatement-5e181e17.fb867057a18ccd94.json"},{"attributes":{"category":"financial_reporting","domain":["Financial Reporting Controls (SOX)"],"inherent_rating":"medium","taxonomy":["sox-rmm-assertion"]},"htmlUrl":"/agents/records/risk-fin-rights-obligations-relatedparty-60258f56.html","id":"risk:fin-rights-obligations-relatedparty","title":"Rights, obligations and related-party misstatement","type":"risk","url":"/assets/agent_record-risk-fin-rights-obligations-relatedparty-60258f56.8346d8c814baaf6c.json"},{"attributes":{"category":"financial_reporting","domain":["Financial Reporting Controls (SOX)","Access Control & Identity Management","Compliance, Audit & Assurance"],"inherent_rating":"high","taxonomy":["coso-erm-risk","sox-rmm-assertion"]},"htmlUrl":"/agents/records/risk-fin-segregation-of-duties-eb7ee015.html","id":"risk:fin-segregation-of-duties","title":"Segregation-of-duties conflicts in financial processes","type":"risk","url":"/assets/agent_record-risk-fin-segregation-of-duties-eb7ee015.da25c6668c301894.json"},{"attributes":{"category":"financial_reporting","domain":["Financial Reporting Controls (SOX)"],"inherent_rating":"medium","taxonomy":["sox-rmm-assertion"]},"htmlUrl":"/agents/records/risk-fin-tax-provision-misstatement-55b9f382.html","id":"risk:fin-tax-provision-misstatement","title":"Tax provision, deferred-tax and uncertain-position misstatement","type":"risk","url":"/assets/agent_record-risk-fin-tax-provision-misstatement-55b9f382.25063fca559a0654.json"},{"attributes":{"category":"financial_reporting","domain":["Financial Reporting Controls (SOX)"],"inherent_rating":"high","taxonomy":["sox-rmm-assertion"]},"htmlUrl":"/agents/records/risk-fin-valuation-impairment-07037c02.html","id":"risk:fin-valuation-impairment","title":"Valuation and impairment misstatement","type":"risk","url":"/assets/agent_record-risk-fin-valuation-impairment-07037c02.f49bda2ce0757bf7.json"},{"attributes":{"category":"financial","domain":["Risk Assessment & Management"],"inherent_rating":"high","taxonomy":["enterprise-risk","coso-erm-risk"]},"htmlUrl":"/agents/records/risk-financial-credit-market-risk-b9cbc5a3.html","id":"risk:financial-credit-market-risk","title":"Credit and market (rate/FX) risk","type":"risk","url":"/assets/agent_record-risk-financial-credit-market-risk-b9cbc5a3.c3ceceb3662b9c9e.json"},{"attributes":{"category":"financial","domain":["Risk Assessment & Management"],"inherent_rating":"high","taxonomy":["enterprise-risk","coso-erm-risk"]},"htmlUrl":"/agents/records/risk-financial-liquidity-capital-e0ac2d24.html","id":"risk:financial-liquidity-capital","title":"Liquidity, capital-structure and refinancing risk","type":"risk","url":"/assets/agent_record-risk-financial-liquidity-capital-e0ac2d24.0f938fc816181917.json"},{"attributes":{"category":"operational","domain":["Access Control & Identity Management","Risk Assessment & Management"],"inherent_rating":"high","taxonomy":["basel-operational-risk","coso-erm-risk"]},"htmlUrl":"/agents/records/risk-fraud-external-c3ce412f.html","id":"risk:fraud-external","title":"External fraud — third-party theft, forgery, payment and account fraud","type":"risk","url":"/assets/agent_record-risk-fraud-external-c3ce412f.ed2b6629b6a7dc3a.json"},{"attributes":{"category":"operational","domain":["Governance, Policy & Oversight","Financial Reporting Controls (SOX)","Risk Assessment & Management"],"inherent_rating":"high","taxonomy":["basel-operational-risk","coso-erm-risk","sox-rmm-assertion"]},"htmlUrl":"/agents/records/risk-fraud-internal-misappropriation-d235cd10.html","id":"risk:fraud-internal-misappropriation","title":"Internal fraud — asset misappropriation, embezzlement, forgery","type":"risk","url":"/assets/agent_record-risk-fraud-internal-misappropriation-d235cd10.340e455cacc8708f.json"}],"schemaVersion":1,"total":172}