{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"strategic","domain":["Governance, Policy & Oversight","Compliance, Audit & Assurance"],"inherent_rating":"high","taxonomy":["coso-erm-risk","iso-27005-vulnerability"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Agov-oversight-failure","description":"Because board and management oversight of risk and control is weak - unclear tone at the top, ineffective board composition or independence, poor committee structure, and limited senior-management commitment - control priorities are not enforced and resources are withheld, so risks accumulate unmanaged and control failures go uncorrected across the entity.","details":{"category":"strategic","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"gov-oversight-failure","taxonomies":["coso-erm-risk","iso-27005-vulnerability"],"treatment":"mitigate"},"id":"risk:gov-oversight-failure","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Agov-oversight-failure","sourceIds":["cobit-2019","coso-erm","coso-ic","iia-2024","iia-pos-2026-erm","nis2","nist-csf-2","soc2","sox"],"sourceUrl":null,"title":"Inadequate board and management oversight of risk and control","type":"risk"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:1018a9854bd07d212a05575e2cfae462b9a6473a7a729ed85635464ea7521b11","properties":{"rationale":"Reporting QAIP results and performance measures to the board lets it oversee audit quality.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-19-a0f61a19.json","sourceId":"uc:UC-AUDIT-19","targetDetailPath":"/data/v1/records/risk-gov-oversight-failure-d98ffc12.json","targetId":"risk:gov-oversight-failure","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2a254c4455b8b44db615085689669bef86efe814f514a6d0bceeb9b010556e2c","properties":{"rationale":"Regular CAE-to-board communication on control and assurance matters gives the board information it needs to oversee risk and control.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-18-7ab55995.json","sourceId":"uc:UC-AUDIT-18","targetDetailPath":"/data/v1/records/risk-gov-oversight-failure-d98ffc12.json","targetId":"risk:gov-oversight-failure","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:37b061e56d22142ddc51e3b30a6612e15b06727b53790c237c770be9ccebc719","properties":{"rationale":"A board-approved risk-based plan directs independent assurance to the key risks the board must oversee.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-09-f23ecfe4.json","sourceId":"uc:UC-AUDIT-09","targetDetailPath":"/data/v1/records/risk-gov-oversight-failure-d98ffc12.json","targetId":"risk:gov-oversight-failure","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:5281390054b41163d7d644d1c520e88598f1a899f13fd5818c8d8839e14fa9c3","properties":{"rationale":"Board independence, expertise, and oversight of the control and risk program is the direct control against inadequate board oversight.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-05-b3a47944.json","sourceId":"uc:UC-GOV-05","targetDetailPath":"/data/v1/records/risk-gov-oversight-failure-d98ffc12.json","targetId":"risk:gov-oversight-failure","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:55d98f71337b6a07fdde1ba619995d8b78c179bbbb0d05e658965b71a4099f89","properties":{"rationale":"Leadership demonstrating integrity and a risk-aware culture directly addresses the unclear tone at the top driving oversight failure.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-04-849a3e91.json","sourceId":"uc:UC-GOV-04","targetDetailPath":"/data/v1/records/risk-gov-oversight-failure-d98ffc12.json","targetId":"risk:gov-oversight-failure","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7a7bb0776fecaa413c9d82396f6ee5bf837a684c6c5bc4f89ef5268bc9efb92b","properties":{"rationale":"Establishing governance decision rights, accountability, and direction-setting is the operative defense against weak board/management oversight.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-01-e1e2136d.json","sourceId":"uc:UC-GOV-01","targetDetailPath":"/data/v1/records/risk-gov-oversight-failure-d98ffc12.json","targetId":"risk:gov-oversight-failure","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:930f418d6fb2fb0993099447e2b1630c944872e34a3115b916f946cc9a9b576b","properties":{"rationale":"Leadership periodically reviewing risk/cyber strategy and program performance against metrics and adjusting direction is the operative oversight mechanism.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-22-2a70149b.json","sourceId":"uc:UC-AUDIT-22","targetDetailPath":"/data/v1/records/risk-gov-oversight-failure-d98ffc12.json","targetId":"risk:gov-oversight-failure","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:964afe1d1b1bc2392fff55e8277931f6b797ec0e663a915cffcd58d9291f2fd2","properties":{"rationale":"CAE functional reporting and unrestricted board access give the board independent assurance, supporting effective oversight of risk and control.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-01-10668058.json","sourceId":"uc:UC-AUDIT-01","targetDetailPath":"/data/v1/records/risk-gov-oversight-failure-d98ffc12.json","targetId":"risk:gov-oversight-failure","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9a07b7df090f88c1acbdeb515c47b435bb1c3d0e9def6b260cdd330d2d8bdecd","properties":{"rationale":"Escalating risk acceptance beyond appetite to senior management and the board is a governance safeguard supporting oversight.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-17-94dc7e0c.json","sourceId":"uc:UC-AUDIT-17","targetDetailPath":"/data/v1/records/risk-gov-oversight-failure-d98ffc12.json","targetId":"risk:gov-oversight-failure","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b1e16ff37b7788cddcaff117e565a57281b7e8ea1bae9adff66e1f8f87628b49","properties":{"rationale":"Board oversight of the CAE, plan, and budget through executive sessions is core machinery strengthening board oversight of risk and control.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-03-927ae903.json","sourceId":"uc:UC-AUDIT-03","targetDetailPath":"/data/v1/records/risk-gov-oversight-failure-d98ffc12.json","targetId":"risk:gov-oversight-failure","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:cee9830981bb501c536589317595878844386d2e89167b60b0e6854b3428288b","properties":{"rationale":"Delivering engagement conclusions and findings to the board and management is a direct information input to risk and control oversight.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-16-03aa1161.json","sourceId":"uc:UC-AUDIT-16","targetDetailPath":"/data/v1/records/risk-gov-oversight-failure-d98ffc12.json","targetId":"risk:gov-oversight-failure","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d10c1c3aabffb486e565c1b410b919bdf14d20365268addd5171c51cfde84a69","properties":{"rationale":"Communicating the impact of resource constraints on audit coverage to the board informs its oversight of assurance gaps.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-10-fc9abe7f.json","sourceId":"uc:UC-AUDIT-10","targetDetailPath":"/data/v1/records/risk-gov-oversight-failure-d98ffc12.json","targetId":"risk:gov-oversight-failure","type":"mitigates"}],"schemaVersion":1}