{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"compliance_regulatory","domain":["Compliance, Audit & Assurance","Governance, Policy & Oversight"],"inherent_rating":"high","taxonomy":["enterprise-risk","coso-erm-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Acompliance-litigation-enforcement","description":"Adverse judgments, class actions, contract/IP disputes, government subpoenas, DOJ/FTC/SEC investigations, consent decrees, or deferred-prosecution agreements imposing penalties, remediation, and management distraction.","details":{"category":"compliance_regulatory","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"compliance-litigation-enforcement","taxonomies":["enterprise-risk","coso-erm-risk"],"treatment":"transfer"},"id":"risk:compliance-litigation-enforcement","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Acompliance-litigation-enforcement","sourceIds":["cobit-2019","gdpr","hipaa","iso-27001","nis2","nist-800-53","nist-csf-2","nydfs-500","pci-dss","soc2"],"sourceUrl":null,"title":"Litigation, investigation and enforcement exposure","type":"risk"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:0829af2246a85e7e5cc486581d228bba50e080557016bad92e46f06a89d07cae","properties":{"rationale":"Maintaining policies required by HIPAA/PCI/regulators reduces enforcement exposure for missing governance documentation.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-14-f4f2c470.json","sourceId":"uc:UC-GOV-14","targetDetailPath":"/data/v1/records/risk-compliance-litigation-enforcement-25e7935d.json","targetId":"risk:compliance-litigation-enforcement","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:19df976fd50d8d8f0e75c8b6bec8e72fbb082fc3316bdbcb966ec4e1f90645a5","properties":{"rationale":"Tracking and resolving privacy complaints and accounting for disclosures satisfies data-subject rights, reducing regulatory escalation.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-27-a70f09a0.json","sourceId":"uc:UC-GOV-27","targetDetailPath":"/data/v1/records/risk-compliance-litigation-enforcement-25e7935d.json","targetId":"risk:compliance-litigation-enforcement","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2577b41fb6b769b270deb98d35b352acd8e77e47cd7f1891ca9045efbdced96b","properties":{"rationale":"Maintaining a current register of legal/regulatory/contractual obligations and assigning how each is met reduces enforcement and litigation exposure.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-03-9e248eb3.json","sourceId":"uc:UC-GOV-03","targetDetailPath":"/data/v1/records/risk-compliance-litigation-enforcement-25e7935d.json","targetId":"risk:compliance-litigation-enforcement","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2e2abe0fbff9b68c4f91b916bf70c55fe062e56b642512c80dca96c4ae9d18d8","properties":{"rationale":"Maintaining authority contacts and staying abreast of regulatory expectations is a supporting relationship/awareness control, not the operative enforcement-avoidance defense.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-23-e22e7c62.json","sourceId":"uc:UC-GOV-23","targetDetailPath":"/data/v1/records/risk-compliance-litigation-enforcement-25e7935d.json","targetId":"risk:compliance-litigation-enforcement","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:44a783c0681fd9d954b59659de9e9f362dce42f65b9e47d5f9b98cb386abce52","properties":{"rationale":"Enforcing lawful, purpose-limited, minimized data processing (GDPR Art5) directly reduces data-protection enforcement exposure.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-26-3952a3ca.json","sourceId":"uc:UC-GOV-26","targetDetailPath":"/data/v1/records/risk-compliance-litigation-enforcement-25e7935d.json","targetId":"risk:compliance-litigation-enforcement","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:53e5d40889536378c608acbfacff804b7d936577fb09f9cad0e0ba757f90ea3b","properties":{"rationale":"Retention limits and secure disposal of nonpublic data reduce over-retention and legal exposure.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-30-6e914c26.json","sourceId":"uc:UC-GOV-30","targetDetailPath":"/data/v1/records/risk-compliance-litigation-enforcement-25e7935d.json","targetId":"risk:compliance-litigation-enforcement","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:6a395e5bdd2e15e676e1508c2595987a0b3e68accf57e99be3b01eb9e860e818","properties":{"rationale":"Notifying regulators within mandated timelines and filing required certifications avoids penalties for late or missing regulatory reporting.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-24-b737644b.json","sourceId":"uc:UC-GOV-24","targetDetailPath":"/data/v1/records/risk-compliance-litigation-enforcement-25e7935d.json","targetId":"risk:compliance-litigation-enforcement","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b9cdb7728148e892209633b56ce9552539b1691ac4b46ca99062f9fe23e1a793","properties":{"rationale":"A privacy program that ensures and demonstrates compliance directly reduces privacy regulatory enforcement (GDPR).","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-25-7960cafc.json","sourceId":"uc:UC-GOV-25","targetDetailPath":"/data/v1/records/risk-compliance-litigation-enforcement-25e7935d.json","targetId":"risk:compliance-litigation-enforcement","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:f8a6f81e052712b32e1ddf11342cc7f624268cdfffbbb3ced7891611fb002135","properties":{"rationale":"Documented compliance evaluation and remediation of non-compliance reduces exposure to enforcement actions and litigation.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-24-fa96fe18.json","sourceId":"uc:UC-AUDIT-24","targetDetailPath":"/data/v1/records/risk-compliance-litigation-enforcement-25e7935d.json","targetId":"risk:compliance-litigation-enforcement","type":"mitigates"}],"schemaVersion":1}