{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"administrative","domain":"Risk Assessment & Management","type":"detective"},"canonicalUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-RISK-13","description":"The organization performs ongoing and separate evaluations of risk management and internal control performance, periodically measuring the framework's effectiveness against its design and intended outcomes. Risk and business performance are reviewed together at defined intervals and results are reported to accountable management. Evaluation schedules, results, and review minutes are retained as evidence.","details":{"control_category":"administrative","control_type":"detective","domain":"Risk Assessment & Management","guidance":[],"members":[{"control_id":"CC4.1","coverage":"full","framework":"soc2","relationship":"superset_of"},{"control_id":"31000-PR7","coverage":"full","framework":"iso-31000","relationship":"superset_of"},{"control_id":"31000-FW5","coverage":"full","framework":"iso-31000","relationship":"superset_of"},{"control_id":"E16","coverage":"full","framework":"coso-erm","relationship":"superset_of"}],"statement":"The organization performs ongoing and separate evaluations of risk management and internal control performance, periodically measuring the framework's effectiveness against its design and intended outcomes. Risk and business performance are reviewed together at defined intervals and results are reported to accountable management. Evaluation schedules, results, and review minutes are retained as evidence.","title":"Monitor and review risk management performance","unified_id":"UC-RISK-13"},"id":"uc:UC-RISK-13","mapUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-RISK-13","sourceIds":["coso-erm","iso-31000","soc2"],"sourceUrl":null,"title":"UC-RISK-13 — Monitor and review risk management performance","type":"unified"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:15e2a0a422fae6670465f06a6330d85892e73e1b6c1d319d96260e3c38e4fa07","properties":{},"sourceDetailPath":"/data/v1/records/wf-d53-e1a69743.json","sourceId":"wf:D53","targetDetailPath":"/data/v1/records/uc-uc-risk-13-75b9f6c7.json","targetId":"uc:UC-RISK-13","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:24b869c67dad40c5667ffef07d50f6bc774dfca61aa04e40c75efeca9f9d9ba8","properties":{"control_id":"CC4.1","coverage":"full","delta":null,"framework":"soc2","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2017 TSC"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-13-75b9f6c7.json","sourceId":"uc:UC-RISK-13","targetDetailPath":"/data/v1/records/ctrl-soc2-cc4-1-12630f31.json","targetId":"ctrl:soc2:CC4.1","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2eb3bf860527ae764ceb223797b7c644151e7196d1c96259d91b201567ae61c5","properties":{"rationale":"Monitoring/reviewing the framework's own performance detects process decay, but is meta-monitoring of the program, not the operative assessment steps; ongoing risk monitoring itself sits in the register/reassessment controls.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-13-75b9f6c7.json","sourceId":"uc:UC-RISK-13","targetDetailPath":"/data/v1/records/risk-risk-assessment-inadequate-328128b5.json","targetId":"risk:risk-assessment-inadequate","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:397d6a9f3645df04d18f6a044b7452585127fcb92a1842f5296ddf5b911c9ec1","properties":{"control_id":"E16","coverage":"full","delta":null,"framework":"coso-erm","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2017"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-13-75b9f6c7.json","sourceId":"uc:UC-RISK-13","targetDetailPath":"/data/v1/records/ctrl-coso-erm-e16-31120406.json","targetId":"ctrl:coso-erm:E16","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:76e05aaab0ea4a7acc1c00ab42c92fa5c1955098c54bfedd6feef3b0d37e0c4f","properties":{},"sourceDetailPath":"/data/v1/records/wf-a15-e859f6b8.json","sourceId":"wf:A15","targetDetailPath":"/data/v1/records/uc-uc-risk-13-75b9f6c7.json","targetId":"uc:UC-RISK-13","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7b14cc3ff44ca206173550e43410b9e421d33922cc54ffd80a58d271b30580ab","properties":{"control_id":"31000-PR7","coverage":"full","delta":null,"framework":"iso-31000","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2018"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-13-75b9f6c7.json","sourceId":"uc:UC-RISK-13","targetDetailPath":"/data/v1/records/ctrl-iso-31000-31000-pr7-97876ceb.json","targetId":"ctrl:iso-31000:31000-PR7","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:85f0dedff23b18e2cce9cf1901f9b69491cf687e3fa1b14983e6d9e3f59f16db","properties":{},"sourceDetailPath":"/data/v1/records/wf-c1-f9e3db77.json","sourceId":"wf:C1","targetDetailPath":"/data/v1/records/uc-uc-risk-13-75b9f6c7.json","targetId":"uc:UC-RISK-13","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:861abd38e6471a76e5eed8880fa96ea55f1bf7c9335c5285d2007d32ed6236ea","properties":{},"sourceDetailPath":"/data/v1/records/wf-g23-1ec4df53.json","sourceId":"wf:G23","targetDetailPath":"/data/v1/records/uc-uc-risk-13-75b9f6c7.json","targetId":"uc:UC-RISK-13","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:89f547ea97977374f64e1f08599c44a7e5d439db08ccd0338ee6000261c6df44","properties":{},"sourceDetailPath":"/data/v1/records/wf-d50-366fc8d4.json","sourceId":"wf:D50","targetDetailPath":"/data/v1/records/uc-uc-risk-13-75b9f6c7.json","targetId":"uc:UC-RISK-13","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:94ceae622bfeb938953b752ecc481e3e535714c3748d7a85c35160ff3bf8eae3","properties":{},"sourceDetailPath":"/data/v1/records/wf-g4-a265153d.json","sourceId":"wf:G4","targetDetailPath":"/data/v1/records/uc-uc-risk-13-75b9f6c7.json","targetId":"uc:UC-RISK-13","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b86311a530394ad814469234723661fd437c5ddd2cae6653f86e785788d076be","properties":{},"sourceDetailPath":"/data/v1/records/wf-g32-7729a23e.json","sourceId":"wf:G32","targetDetailPath":"/data/v1/records/uc-uc-risk-13-75b9f6c7.json","targetId":"uc:UC-RISK-13","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:ceb9f621e496d27d5aad439374f0c859b63b6398d8687438d7b048f616e4eb33","properties":{},"sourceDetailPath":"/data/v1/records/wf-g11-62e4fa80.json","sourceId":"wf:G11","targetDetailPath":"/data/v1/records/uc-uc-risk-13-75b9f6c7.json","targetId":"uc:UC-RISK-13","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d6ed284de56ace12f7b7eefc3703a0c75858bf2f8b0f57dd78dc4d8bd39e7ed9","properties":{"rationale":"","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-13-75b9f6c7.json","sourceId":"uc:UC-RISK-13","targetDetailPath":"/data/v1/records/risk-ai-environmental-footprint-c86cf6c9.json","targetId":"risk:ai-environmental-footprint","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e1dd84eb911b18a4df48a7c8e04205ae4f74ef3be313e542bd91cd1422a54004","properties":{"control_id":"31000-FW5","coverage":"full","delta":null,"framework":"iso-31000","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2018"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-13-75b9f6c7.json","sourceId":"uc:UC-RISK-13","targetDetailPath":"/data/v1/records/ctrl-iso-31000-31000-fw5-2768e6fc.json","targetId":"ctrl:iso-31000:31000-FW5","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e6ce5b4d4a5c4a1a16f3dcac74098d722e6710d58cfe9fcd6f0207c31585c64c","properties":{},"sourceDetailPath":"/data/v1/records/wf-c2-a1078981.json","sourceId":"wf:C2","targetDetailPath":"/data/v1/records/uc-uc-risk-13-75b9f6c7.json","targetId":"uc:UC-RISK-13","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:eb93282202b2513404526abe258f89148b8ba4a6f81b9f111b2615b15ead0ff3","properties":{"rationale":"","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-13-75b9f6c7.json","sourceId":"uc:UC-RISK-13","targetDetailPath":"/data/v1/records/risk-ops-product-service-quality-2066b257.json","targetId":"risk:ops-product-service-quality","type":"mitigates"}],"schemaVersion":1}