{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"administrative","domain":"Risk Assessment & Management","type":"corrective"},"canonicalUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-RISK-15","description":"Lessons from evaluations, monitoring, and operating experience are translated into improvements to the risk management framework and process. Improvement actions are planned, assigned owners, and tracked to completion, and the framework is continually adapted to remain suitable for the organization. Improvement backlogs and completed-action evidence demonstrate operation.","details":{"control_category":"administrative","control_type":"corrective","domain":"Risk Assessment & Management","guidance":[],"members":[{"control_id":"31000-P8","coverage":"full","framework":"iso-31000","relationship":"superset_of"},{"control_id":"31000-FW6","coverage":"full","framework":"iso-31000","relationship":"superset_of"},{"control_id":"E17","coverage":"full","framework":"coso-erm","relationship":"superset_of"},{"control_id":"ID.IM-01","coverage":"full","framework":"nist-csf-2","relationship":"superset_of"}],"statement":"Lessons from evaluations, monitoring, and operating experience are translated into improvements to the risk management framework and process. Improvement actions are planned, assigned owners, and tracked to completion, and the framework is continually adapted to remain suitable for the organization. Improvement backlogs and completed-action evidence demonstrate operation.","title":"Continually improve the risk management program","unified_id":"UC-RISK-15"},"id":"uc:UC-RISK-15","mapUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-RISK-15","sourceIds":["coso-erm","iso-31000","nist-csf-2"],"sourceUrl":null,"title":"UC-RISK-15 — Continually improve the risk management program","type":"unified"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:0c3352958d878278a91613add115b1b763d0277a5b1a7e37cdcf4c8f808e5577","properties":{},"sourceDetailPath":"/data/v1/records/wf-g23-1ec4df53.json","sourceId":"wf:G23","targetDetailPath":"/data/v1/records/uc-uc-risk-15-e01fb134.json","targetId":"uc:UC-RISK-15","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:1edb80670c202f554622f58d46a3add49b2a5cbd560424619524914869bc2428","properties":{"control_id":"31000-FW6","coverage":"full","delta":null,"framework":"iso-31000","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2018"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-15-e01fb134.json","sourceId":"uc:UC-RISK-15","targetDetailPath":"/data/v1/records/ctrl-iso-31000-31000-fw6-caaa68bb.json","targetId":"ctrl:iso-31000:31000-FW6","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:562ed1f4d761bf88a5acd404fdeb05426f0e1d6b92c82f1e669169ae5d60bb92","properties":{"rationale":"","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-15-e01fb134.json","sourceId":"uc:UC-RISK-15","targetDetailPath":"/data/v1/records/risk-ai-power-concentration-societal-473c979a.json","targetId":"risk:ai-power-concentration-societal","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:72ffde935f696b703eea046c531a92e285ac71f3eaf3d977058b2d3f607b5a63","properties":{"control_id":"31000-P8","coverage":"full","delta":null,"framework":"iso-31000","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2018"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-15-e01fb134.json","sourceId":"uc:UC-RISK-15","targetDetailPath":"/data/v1/records/ctrl-iso-31000-31000-p8-251dfb3d.json","targetId":"ctrl:iso-31000:31000-P8","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9e1dd44af111fe5210a4caf943b2f11f00f4a341bdf3149dbca73e398823c219","properties":{"rationale":"Continually improving the framework from lessons sustains the process's suitability over time, but acts on the program rather than operating the assessment steps; a second-order contributor to sustained adequacy, not operative defense.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-15-e01fb134.json","sourceId":"uc:UC-RISK-15","targetDetailPath":"/data/v1/records/risk-risk-assessment-inadequate-328128b5.json","targetId":"risk:risk-assessment-inadequate","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a69d204783e3b57eec97a2c2df3adfaa0c2392a893f12f0757ae4e829858a764","properties":{},"sourceDetailPath":"/data/v1/records/wf-c2-a1078981.json","sourceId":"wf:C2","targetDetailPath":"/data/v1/records/uc-uc-risk-15-e01fb134.json","targetId":"uc:UC-RISK-15","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a825661de87efa6ca5dffad5aa3656583111dc5d964438819866347a190d7978","properties":{},"sourceDetailPath":"/data/v1/records/wf-d05-2302db1f.json","sourceId":"wf:D05","targetDetailPath":"/data/v1/records/uc-uc-risk-15-e01fb134.json","targetId":"uc:UC-RISK-15","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:c0bae0dccc8f1428dc38fe0134176e0295206acb8b916d735b708929fd762606","properties":{"rationale":"","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-15-e01fb134.json","sourceId":"uc:UC-RISK-15","targetDetailPath":"/data/v1/records/risk-ops-product-service-quality-2066b257.json","targetId":"risk:ops-product-service-quality","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:cf2cfba7148996d1d10c1f51d8f5aba1d8448c96b182a70314fb11ecd83849b3","properties":{"control_id":"E17","coverage":"full","delta":null,"framework":"coso-erm","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2017"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-15-e01fb134.json","sourceId":"uc:UC-RISK-15","targetDetailPath":"/data/v1/records/ctrl-coso-erm-e17-b3a68941.json","targetId":"ctrl:coso-erm:E17","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e453d3a9ca6c44cb3a341446be6d886573e333ded756c4f997418ac729e64c0d","properties":{"control_id":"ID.IM-01","coverage":"full","delta":null,"framework":"nist-csf-2","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2.0"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-15-e01fb134.json","sourceId":"uc:UC-RISK-15","targetDetailPath":"/data/v1/records/ctrl-nist-csf-2-id-im-01-d57c733e.json","targetId":"ctrl:nist-csf-2:ID.IM-01","type":"maps_to"}],"schemaVersion":1}