{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"administrative","domain":"Risk Assessment & Management","type":"preventive"},"canonicalUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-RISK-01","description":"Senior leadership establishes, approves, and visibly sponsors an enterprise risk management framework customized to the organization's external and internal context. The framework design defines accountabilities, resources, and processes for managing risk, and the framework is implemented across the organization on a planned schedule. Where regulated technologies such as high-risk AI systems are in scope, the framework is extended with the required lifecycle-specific risk processes. Approved framework documentation and implementation plans are retained as evidence.","details":{"control_category":"administrative","control_type":"preventive","domain":"Risk Assessment & Management","guidance":[],"members":[{"control_id":"31000-FW1","coverage":"full","framework":"iso-31000","relationship":"superset_of"},{"control_id":"31000-FW3","coverage":"full","framework":"iso-31000","relationship":"superset_of"},{"control_id":"31000-FW4","coverage":"full","framework":"iso-31000","relationship":"superset_of"},{"control_id":"31000-P3","coverage":"full","framework":"iso-31000","relationship":"superset_of"},{"control_id":"AIA-Art9","coverage":"partial","delta":"EU AI Act adds AI-lifecycle-specific continuous risk process and testing","framework":"eu-ai-act","relationship":"intersects_with"}],"statement":"Senior leadership establishes, approves, and visibly sponsors an enterprise risk management framework customized to the organization's external and internal context. The framework design defines accountabilities, resources, and processes for managing risk, and the framework is implemented across the organization on a planned schedule. Where regulated technologies such as high-risk AI systems are in scope, the framework is extended with the required lifecycle-specific risk processes. Approved framework documentation and implementation plans are retained as evidence.","title":"Establish and maintain a tailored risk management framework","unified_id":"UC-RISK-01"},"id":"uc:UC-RISK-01","mapUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-RISK-01","sourceIds":["eu-ai-act","iso-31000"],"sourceUrl":null,"title":"UC-RISK-01 — Establish and maintain a tailored risk management framework","type":"unified"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:053894cbc795235041b15d1e803cfd21ad0a4f3e12ea6f574ebf2b37bf03e502","properties":{"rationale":"AI-Act Art 9 lifecycle risk processes in the framework establish the governance under which high-risk-AI safety risks are identified and mitigated.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-01-13d56297.json","sourceId":"uc:UC-RISK-01","targetDetailPath":"/data/v1/records/risk-ai-safety-harm-to-people-d02cb500.json","targetId":"risk:ai-safety-harm-to-people","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7c8c831f60da8b2a84743b237bbffdde0a7b4f290d5b862faa0e3d79ae769561","properties":{"control_id":"AIA-Art9","coverage":"partial","delta":"EU AI Act adds AI-lifecycle-specific continuous risk process and testing","framework":"eu-ai-act","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"Regulation (EU) 2024/1689"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-01-13d56297.json","sourceId":"uc:UC-RISK-01","targetDetailPath":"/data/v1/records/ctrl-eu-ai-act-aia-art9-1aacf4f0.json","targetId":"ctrl:eu-ai-act:AIA-Art9","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:82261d4bfcb0c34be642562f348896f110e7bb4960a4f65ec5685d4efccea722","properties":{"control_id":"31000-FW1","coverage":"full","delta":null,"framework":"iso-31000","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2018"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-01-13d56297.json","sourceId":"uc:UC-RISK-01","targetDetailPath":"/data/v1/records/ctrl-iso-31000-31000-fw1-112c0ed5.json","targetId":"ctrl:iso-31000:31000-FW1","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:88db5bf5f404b4c0944be6f79b27363f6d2bc42c4eeae4b133f6576d29894ad4","properties":{"control_id":"31000-FW3","coverage":"full","delta":null,"framework":"iso-31000","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2018"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-01-13d56297.json","sourceId":"uc:UC-RISK-01","targetDetailPath":"/data/v1/records/ctrl-iso-31000-31000-fw3-21cc689c.json","targetId":"ctrl:iso-31000:31000-FW3","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b4424862ed92282ece0b8ae99b66cb94fb06b9093704e70a4c18fb55df20e7bf","properties":{"control_id":"31000-P3","coverage":"full","delta":null,"framework":"iso-31000","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2018"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-01-13d56297.json","sourceId":"uc:UC-RISK-01","targetDetailPath":"/data/v1/records/ctrl-iso-31000-31000-p3-fda14ae5.json","targetId":"ctrl:iso-31000:31000-P3","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:ba7b966f8a1ebe9cfbf3fc12b20338388d851c39aa09f232ead434f202281d98","properties":{"control_id":"31000-FW4","coverage":"full","delta":null,"framework":"iso-31000","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2018"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-01-13d56297.json","sourceId":"uc:UC-RISK-01","targetDetailPath":"/data/v1/records/ctrl-iso-31000-31000-fw4-b350dbe6.json","targetId":"ctrl:iso-31000:31000-FW4","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:ca75ce1842ad6dbf57f03c7a75c4dfc9f26e0776873f0c10b85ae02963722f3b","properties":{"rationale":"Establishing/maintaining an ERM framework is the direct antidote to having no systematic process to identify, analyse, evaluate and treat risk.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-01-13d56297.json","sourceId":"uc:UC-RISK-01","targetDetailPath":"/data/v1/records/risk-risk-assessment-inadequate-328128b5.json","targetId":"risk:risk-assessment-inadequate","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:f71b5fac8b1a27b328ed3fc4b12d4f7ae5bc4ee209c1f78b763be18d277cf457","properties":{"rationale":"EU AI Act Art 9 member extends the framework with a high-risk-AI risk-management system governing identification/mitigation of accuracy risks; framework enables, not operates, the defense.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-01-13d56297.json","sourceId":"uc:UC-RISK-01","targetDetailPath":"/data/v1/records/risk-ai-inaccurate-unreliable-output-cf10c86e.json","targetId":"risk:ai-inaccurate-unreliable-output","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:fdfff27500e0c780aba9597532b29312daa28ecd701cfd89faa25108e0f26396","properties":{},"sourceDetailPath":"/data/v1/records/wf-g16-694f4e2b.json","sourceId":"wf:G16","targetDetailPath":"/data/v1/records/uc-uc-risk-01-13d56297.json","targetId":"uc:UC-RISK-01","type":"operates"}],"schemaVersion":1}