{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"operational","domain":["Risk Assessment & Management","Governance, Policy & Oversight"],"inherent_rating":"high","taxonomy":["coso-erm-risk","enterprise-risk","nist-privacy-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Arisk-assessment-inadequate","description":"No systematic process to identify, analyse, evaluate, and treat risk — including missing fraud-risk assessment and no ongoing risk monitoring — leaving material exposures unidentified and untreated before they materialise.","details":{"category":"operational","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"risk-assessment-inadequate","taxonomies":["coso-erm-risk","enterprise-risk","nist-privacy-risk"],"treatment":"mitigate"},"id":"risk:risk-assessment-inadequate","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Arisk-assessment-inadequate","sourceIds":["cobit-2019","coso-erm","coso-ic","eu-ai-act","iso-31000","nist-800-53","nist-csf-2","nydfs-500","soc2","sox"],"sourceUrl":null,"title":"Inadequate or absent risk assessment process","type":"risk"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:0a0070742580f23a1c2ff349153e822dde9f43340c2779ce29b38fcdac6e6659","properties":{"rationale":"Evaluating and prioritising analyzed risks against criteria to decide treatment is a core process step countering an assessment that never reaches decisions.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-08-5f27bebc.json","sourceId":"uc:UC-RISK-08","targetDetailPath":"/data/v1/records/risk-risk-assessment-inadequate-328128b5.json","targetId":"risk:risk-assessment-inadequate","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2754750eaaa885c1da8468ff91127cbfa89ad977327a827659f27a030198744b","properties":{"rationale":"A maintained risk register with status and portfolio reporting is the ongoing risk monitoring the risk describes as missing.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-10-6d44f690.json","sourceId":"uc:UC-RISK-10","targetDetailPath":"/data/v1/records/risk-risk-assessment-inadequate-328128b5.json","targetId":"risk:risk-assessment-inadequate","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2eb3bf860527ae764ceb223797b7c644151e7196d1c96259d91b201567ae61c5","properties":{"rationale":"Monitoring/reviewing the framework's own performance detects process decay, but is meta-monitoring of the program, not the operative assessment steps; ongoing risk monitoring itself sits in the register/reassessment controls.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-13-75b9f6c7.json","sourceId":"uc:UC-RISK-13","targetDetailPath":"/data/v1/records/risk-risk-assessment-inadequate-328128b5.json","targetId":"risk:risk-assessment-inadequate","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:3a0f2e69c088ac34e68a1248331a1aa1dab5e336e298d9773e3a5d33693336b7","properties":{"rationale":"Establishing the risk-assessment policy, methodology, appetite, and process directly remedies an absent or inadequate risk-assessment process.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-17-5ee3266f.json","sourceId":"uc:UC-GOV-17","targetDetailPath":"/data/v1/records/risk-risk-assessment-inadequate-328128b5.json","targetId":"risk:risk-assessment-inadequate","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:491879c8cb8b14f518463077e14630f7a4f1a7c89a4ee06d83c3673454f3a430","properties":{"rationale":"Defining risk appetite, tolerance and structured assessment criteria supplies the yardsticks without which risks cannot be consistently calculated, categorised or prioritised.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-03-31e0ad29.json","sourceId":"uc:UC-RISK-03","targetDetailPath":"/data/v1/records/risk-risk-assessment-inadequate-328128b5.json","targetId":"risk:risk-assessment-inadequate","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:534c8d98a58d9a5e55336b56dea75b05990b462c31487f1ed2242dcc39e26d21","properties":{"rationale":"Systematic risk identification and likelihood/impact analysis with consistent severity scales is the analytic core of the risk-assessment process.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-07-b86de728.json","sourceId":"uc:UC-RISK-07","targetDetailPath":"/data/v1/records/risk-risk-assessment-inadequate-328128b5.json","targetId":"risk:risk-assessment-inadequate","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:5b7be723fb0f164ef5cdc55e8a504dbd21539a17751683ec74d21d20eb8abbbe","properties":{"rationale":"Tracking deficiencies and findings to closure via remediation plans helps ensure identified issues are treated, but it is a corrective loop over findings, not the operative identify-analyse-evaluate-treat process; contributor.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-14-a5d6281b.json","sourceId":"uc:UC-RISK-14","targetDetailPath":"/data/v1/records/risk-risk-assessment-inadequate-328128b5.json","targetId":"risk:risk-assessment-inadequate","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9e1dd44af111fe5210a4caf943b2f11f00f4a341bdf3149dbca73e398823c219","properties":{"rationale":"Continually improving the framework from lessons sustains the process's suitability over time, but acts on the program rather than operating the assessment steps; a second-order contributor to sustained adequacy, not operative defense.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-15-e01fb134.json","sourceId":"uc:UC-RISK-15","targetDetailPath":"/data/v1/records/risk-risk-assessment-inadequate-328128b5.json","targetId":"risk:risk-assessment-inadequate","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a21077e4bec07cc3fa7adc371c05d84839954ae452369ee04848bc2a464af6ed","properties":{"rationale":"Selecting, planning and tracking risk treatments to residual-risk re-evaluation is the treat stage; operating it stops exposures being left untreated.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-09-06ffdff1.json","sourceId":"uc:UC-RISK-09","targetDetailPath":"/data/v1/records/risk-risk-assessment-inadequate-328128b5.json","targetId":"risk:risk-assessment-inadequate","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a8d701934e20627e2031ea822b66a45953371b274acf28a0fb1b8c03ef3d4e61","properties":{"rationale":"Specifying objectives and business context clearly is the foundation that makes risk identification and assessment possible; absent it the process is inadequate.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-04-1a2bee69.json","sourceId":"uc:UC-RISK-04","targetDetailPath":"/data/v1/records/risk-risk-assessment-inadequate-328128b5.json","targetId":"risk:risk-assessment-inadequate","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b762f997b3bc0017c1a025bf61e5f61e921d86e77f588f176f280dc4530d151f","properties":{"rationale":"Performing periodic enterprise-wide risk assessments per a documented methodology directly operates the assessment process the risk describes as absent.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-06-e9599494.json","sourceId":"uc:UC-RISK-06","targetDetailPath":"/data/v1/records/risk-risk-assessment-inadequate-328128b5.json","targetId":"risk:risk-assessment-inadequate","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:ca75ce1842ad6dbf57f03c7a75c4dfc9f26e0776873f0c10b85ae02963722f3b","properties":{"rationale":"Establishing/maintaining an ERM framework is the direct antidote to having no systematic process to identify, analyse, evaluate and treat risk.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-01-13d56297.json","sourceId":"uc:UC-RISK-01","targetDetailPath":"/data/v1/records/risk-risk-assessment-inadequate-328128b5.json","targetId":"risk:risk-assessment-inadequate","type":"mitigates"}],"schemaVersion":1}