{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"administrative","domain":"Governance, Policy & Oversight","type":"preventive"},"canonicalUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-GOV-21","description":"Establish channels, responsibilities, and cadences to communicate risk, control, and performance information internally at all levels — including objectives and internal control responsibilities — and with external stakeholders, business partners, and the technology function. Leverage information systems to capture, process, and deliver this reporting, and report on risk, culture, and performance to stakeholders at defined intervals and on significant events.","details":{"control_category":"administrative","control_type":"preventive","domain":"Governance, Policy & Oversight","guidance":[],"members":[{"control_id":"CC2.2","coverage":"full","framework":"soc2","relationship":"superset_of"},{"control_id":"CC2.3","coverage":"full","framework":"soc2","relationship":"superset_of"},{"control_id":"E18","coverage":"full","framework":"coso-erm","relationship":"superset_of"},{"control_id":"E19","coverage":"full","framework":"coso-erm","relationship":"superset_of"},{"control_id":"E20","coverage":"full","framework":"coso-erm","relationship":"superset_of"},{"control_id":"EDM05","coverage":"partial","delta":"evaluating stakeholder engagement/reporting requirements and monitoring engagement effectiveness at the governance layer, beyond performing communication and reporting","framework":"cobit-2019","relationship":"intersects_with"},{"control_id":"APO08","coverage":"partial","delta":"active business-IT relationship and demand management beyond communication","framework":"cobit-2019","relationship":"intersects_with"},{"control_id":"P14","coverage":"full","framework":"coso-ic","relationship":"superset_of"}],"statement":"Establish channels, responsibilities, and cadences to communicate risk, control, and performance information internally at all levels — including objectives and internal control responsibilities — and with external stakeholders, business partners, and the technology function. Leverage information systems to capture, process, and deliver this reporting, and report on risk, culture, and performance to stakeholders at defined intervals and on significant events.","title":"Communicate and report risk and control information","unified_id":"UC-GOV-21"},"id":"uc:UC-GOV-21","mapUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-GOV-21","sourceIds":["cobit-2019","coso-erm","coso-ic","soc2"],"sourceUrl":null,"title":"UC-GOV-21 — Communicate and report risk and control information","type":"unified"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:0d32a23302f8a9d5ade7d9d2e1255ee237df593019fdbf2136c96bc15ee4f853","properties":{"control_id":"CC2.3","coverage":"full","delta":null,"framework":"soc2","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2017 TSC"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-21-8c5d79f9.json","sourceId":"uc:UC-GOV-21","targetDetailPath":"/data/v1/records/ctrl-soc2-cc2-3-b0ace578.json","targetId":"ctrl:soc2:CC2.3","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:0e873b6b40e4867b0de5f11e642f1de223f340361d7a6d3683082b43e2765895","properties":{"control_id":"E19","coverage":"full","delta":null,"framework":"coso-erm","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2017"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-21-8c5d79f9.json","sourceId":"uc:UC-GOV-21","targetDetailPath":"/data/v1/records/ctrl-coso-erm-e19-4985b126.json","targetId":"ctrl:coso-erm:E19","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:13b378c975cf30cc4362e82a56a26a9d162fc9760947e57edc441047ef848989","properties":{},"sourceDetailPath":"/data/v1/records/wf-g11-62e4fa80.json","sourceId":"wf:G11","targetDetailPath":"/data/v1/records/uc-uc-gov-21-8c5d79f9.json","targetId":"uc:UC-GOV-21","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:3168ea42630c60b9d0ac739951d46d166479602d7c0782798906677e43f9f5c4","properties":{},"sourceDetailPath":"/data/v1/records/wf-g32-7729a23e.json","sourceId":"wf:G32","targetDetailPath":"/data/v1/records/uc-uc-gov-21-8c5d79f9.json","targetId":"uc:UC-GOV-21","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:4c10648fc2d053fa77d405cc4d5dec3c727f2b7f0573a819a30fb3d69b6b6919","properties":{},"sourceDetailPath":"/data/v1/records/wf-d54-eba5e14e.json","sourceId":"wf:D54","targetDetailPath":"/data/v1/records/uc-uc-gov-21-8c5d79f9.json","targetId":"uc:UC-GOV-21","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:4fbd0e215c1b15c1eb800748ac761da0d2bf0dde577c169240443ff9cdc16c9f","properties":{"rationale":"Reporting to external stakeholders on risk and performance sustains stakeholder relationships and trust.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-21-8c5d79f9.json","sourceId":"uc:UC-GOV-21","targetDetailPath":"/data/v1/records/risk-reputational-stakeholder-trust-23d21e70.json","targetId":"risk:reputational-stakeholder-trust","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:558adde8cd415d2e733e3c9beea91602c15ef57f824a06d14b007ceb62505c6c","properties":{"control_id":"E18","coverage":"full","delta":null,"framework":"coso-erm","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2017"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-21-8c5d79f9.json","sourceId":"uc:UC-GOV-21","targetDetailPath":"/data/v1/records/ctrl-coso-erm-e18-6386e41e.json","targetId":"ctrl:coso-erm:E18","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:591be707468a6265bfe5d2478bfb4d2519b3ce85e9c50e1c638219edc6d1d600","properties":{},"sourceDetailPath":"/data/v1/records/wf-a15-e859f6b8.json","sourceId":"wf:A15","targetDetailPath":"/data/v1/records/uc-uc-gov-21-8c5d79f9.json","targetId":"uc:UC-GOV-21","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:601c5e75ee6855695300360670afbaa9f56c8a1d35031e1219b30f62a223bca3","properties":{},"sourceDetailPath":"/data/v1/records/wf-d24-a9f3daf6.json","sourceId":"wf:D24","targetDetailPath":"/data/v1/records/uc-uc-gov-21-8c5d79f9.json","targetId":"uc:UC-GOV-21","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:8ab3a0394bc8de1f7ceb8cfab9bb4f44896298d1cf0afb0917732b81cafdc012","properties":{"control_id":"P14","coverage":"full","delta":null,"framework":"coso-ic","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2013"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-21-8c5d79f9.json","sourceId":"uc:UC-GOV-21","targetDetailPath":"/data/v1/records/ctrl-coso-ic-p14-4f2da7a2.json","targetId":"ctrl:coso-ic:P14","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:992d4a2b68122b00a3263d70934f1236bb6a38fa2d31c2a28eecc5d107aceaad","properties":{},"sourceDetailPath":"/data/v1/records/wf-g10-3ef59294.json","sourceId":"wf:G10","targetDetailPath":"/data/v1/records/uc-uc-gov-21-8c5d79f9.json","targetId":"uc:UC-GOV-21","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9a8e31395f1a0aa9f088751b51c22c60cbbc9f1726ba19240d1c674702db153e","properties":{"control_id":"CC2.2","coverage":"full","delta":null,"framework":"soc2","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2017 TSC"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-21-8c5d79f9.json","sourceId":"uc:UC-GOV-21","targetDetailPath":"/data/v1/records/ctrl-soc2-cc2-2-2736ed02.json","targetId":"ctrl:soc2:CC2.2","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9b2ce9e03e035815e780353e25159299363bde25a0e1c67c04e745ce93ad0732","properties":{"control_id":"E20","coverage":"full","delta":null,"framework":"coso-erm","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2017"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-21-8c5d79f9.json","sourceId":"uc:UC-GOV-21","targetDetailPath":"/data/v1/records/ctrl-coso-erm-e20-5b937dac.json","targetId":"ctrl:coso-erm:E20","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a3b4fac9eeb2aeaac7e22e209619356e1fc4b3b7ddba114ab2d9d52d00099493","properties":{"control_id":"EDM05","coverage":"partial","delta":"evaluating stakeholder engagement/reporting requirements and monitoring engagement effectiveness at the governance layer, beyond performing communication and reporting","framework":"cobit-2019","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2019"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-21-8c5d79f9.json","sourceId":"uc:UC-GOV-21","targetDetailPath":"/data/v1/records/ctrl-cobit-2019-edm05-c0483b9a.json","targetId":"ctrl:cobit-2019:EDM05","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b9c2ca8878fa5c9ff9ce6b6324fb5384d4cd02ff0dba9f73ff82079a34e8a89c","properties":{},"sourceDetailPath":"/data/v1/records/wf-s16-ff1d0766.json","sourceId":"wf:S16","targetDetailPath":"/data/v1/records/uc-uc-gov-21-8c5d79f9.json","targetId":"uc:UC-GOV-21","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:c60baa1d81719be18729d8ba4fbebc721afc8135f8e5a1297671beea276ff7db","properties":{},"sourceDetailPath":"/data/v1/records/wf-g23-1ec4df53.json","sourceId":"wf:G23","targetDetailPath":"/data/v1/records/uc-uc-gov-21-8c5d79f9.json","targetId":"uc:UC-GOV-21","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:c9d76ee4fe4efbd3a64021b6b54d269a9a0d5065ee98d870608912652f9d006a","properties":{},"sourceDetailPath":"/data/v1/records/wf-s17-e5271161.json","sourceId":"wf:S17","targetDetailPath":"/data/v1/records/uc-uc-gov-21-8c5d79f9.json","targetId":"uc:UC-GOV-21","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:cd52369e5d7e39f8b078232af5109c0a1b6c6652fc95a026844c654bc3295372","properties":{},"sourceDetailPath":"/data/v1/records/wf-s26-9c764357.json","sourceId":"wf:S26","targetDetailPath":"/data/v1/records/uc-uc-gov-21-8c5d79f9.json","targetId":"uc:UC-GOV-21","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d37a295edb960f587e4d5a2ada322a7e4127b25b1b72e16ed76a1e92c8daf600","properties":{},"sourceDetailPath":"/data/v1/records/wf-d50-366fc8d4.json","sourceId":"wf:D50","targetDetailPath":"/data/v1/records/uc-uc-gov-21-8c5d79f9.json","targetId":"uc:UC-GOV-21","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:da4b42425663414a75d805a4f176e27aabf8b91eefe850884376bfe37b7e09d6","properties":{},"sourceDetailPath":"/data/v1/records/wf-g5-873e0b12.json","sourceId":"wf:G5","targetDetailPath":"/data/v1/records/uc-uc-gov-21-8c5d79f9.json","targetId":"uc:UC-GOV-21","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:eaa1921da3a2649c4cdd39f81d36c57c29574d8188b50a719df47c091df061ea","properties":{"control_id":"APO08","coverage":"partial","delta":"active business-IT relationship and demand management beyond communication","framework":"cobit-2019","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2019"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-21-8c5d79f9.json","sourceId":"uc:UC-GOV-21","targetDetailPath":"/data/v1/records/ctrl-cobit-2019-apo08-6c76314b.json","targetId":"ctrl:cobit-2019:APO08","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:eebc23cf930fc9d7924ffdcc9d469b6529907a8bd31cb525dda6b67b31ebb4a5","properties":{"rationale":"","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-21-8c5d79f9.json","sourceId":"uc:UC-GOV-21","targetDetailPath":"/data/v1/records/risk-fin-crime-aml-sanctions-80b15201.json","targetId":"risk:fin-crime-aml-sanctions","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:fdeba1c7549bbcbca69c9774511ed1ba38557c5b656416ea4bcfbbf84c3ed306","properties":{},"sourceDetailPath":"/data/v1/records/wf-s24-2c7b50f9.json","sourceId":"wf:S24","targetDetailPath":"/data/v1/records/uc-uc-gov-21-8c5d79f9.json","targetId":"uc:UC-GOV-21","type":"operates"}],"schemaVersion":1}