{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","download":{"releaseId":"sha256:a9b7771d4a349b09631c9de418215f6f44afa4c44bd3c01f6e11d5431aa862d8","slug":"grc-risk-communication-reporting-performance-review","url":"/assets/agent_workflow-grc-risk-communication-reporting-performance-review-b140a191.0cd813b07dd5f64e.json"},"kind":"record","record":{"attributes":{"department":"risk-management","domain":"grc","lineOfDefense":"operate"},"canonicalUrl":"https://workflow-library.com/all/?w=grc-risk-communication-reporting-performance-review","description":"Risk Communication, Reporting & Performance Review as a decision-aware workflow that runs each quarter or on an out-of-cycle significant matter. Because none of the eight Studio item types represents the ERM reporting cycle itself, the workflow instance IS the durable record: its named deliverables - the tiered internal and external risk, control and performance reporting package, the event-driven report on a significant matter, the management-signed risk-and-control performance-review pack, and the tracked improvement actions - attach to its steps, its item-level writes land on the existing Risk, Control, and Issue items (improvement actions are tracked as Issues with source: self_assessment); control-testing results are read from SOX testing workflows hosted directly on the relevant Controls; and the risk-management framework is read as its Policy item (policy_type: charter) for the evaluation baseline and the suppliers and third parties consulted as their Vendor items. In scope: stakeholder consultation across every risk-process step (identification, assessment, response, monitoring) including suppliers and third parties; the cadenced internal and external reporting package; event-driven reporting on significant matters; the periodic review of risk-management and internal-control performance against the framework's design intent with accountable management; and converting lessons into owned, tracked improvement actions. Out of scope: running the underlying risk assessments, control testing, or business-performance measurement themselves - this workflow consumes their results as inputs. It starts on its own trigger (the quarterly cadence or a significant event) and has no upstream feeder workflow and no named downstream handoff workflow; each run's close-and-archive leaves the stakeholder, risk, and improvement registers current - the informal handoff both to the next cycle of this workflow and to the downstream risk-assessment and control-testing workflows whose results this cycle consumes.","details":{"canonicalUrl":"https://workflow-library.com/all/?w=grc-risk-communication-reporting-performance-review","capabilities":[],"controls":["UC-RISK-05","UC-GOV-21","UC-RISK-13","UC-RISK-15"],"domains":["grc"],"lineOfDefense":"operate","mappingStatus":"mapped","releaseId":"sha256:a9b7771d4a349b09631c9de418215f6f44afa4c44bd3c01f6e11d5431aa862d8","roleIntegrity":{"activityCount":0,"ermPhases":[],"lineRoles":[],"serviceModes":[],"warnings":[]},"sourceTemplateId":"workflow-library:grc-risk-communication-reporting-performance-review","standards":["iso-31000","coso-erm","soc2","nist-csf-2"],"teams":["risk-management"]},"id":"wf:G23","mapUrl":"https://controlsmap.com/?v=1&node=wf%3AG23","slug":"grc-risk-communication-reporting-performance-review","sourceIds":["cobit-2019","coso-erm","coso-ic","iso-31000","nist-csf-2","soc2"],"sourceUrl":null,"title":"Risk Communication, Reporting & Performance Review","type":"workflow"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:0c3352958d878278a91613add115b1b763d0277a5b1a7e37cdcf4c8f808e5577","properties":{},"sourceDetailPath":"/data/v1/records/wf-g23-1ec4df53.json","sourceId":"wf:G23","targetDetailPath":"/data/v1/records/uc-uc-risk-15-e01fb134.json","targetId":"uc:UC-RISK-15","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:861abd38e6471a76e5eed8880fa96ea55f1bf7c9335c5285d2007d32ed6236ea","properties":{},"sourceDetailPath":"/data/v1/records/wf-g23-1ec4df53.json","sourceId":"wf:G23","targetDetailPath":"/data/v1/records/uc-uc-risk-13-75b9f6c7.json","targetId":"uc:UC-RISK-13","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:c60baa1d81719be18729d8ba4fbebc721afc8135f8e5a1297671beea276ff7db","properties":{},"sourceDetailPath":"/data/v1/records/wf-g23-1ec4df53.json","sourceId":"wf:G23","targetDetailPath":"/data/v1/records/uc-uc-gov-21-8c5d79f9.json","targetId":"uc:UC-GOV-21","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:eddcc856f17ae0a9bd7f09f8f00b98d3068b6d3b88595bb3581d2b6465c4ad1a","properties":{},"sourceDetailPath":"/data/v1/records/wf-g23-1ec4df53.json","sourceId":"wf:G23","targetDetailPath":"/data/v1/records/uc-uc-risk-05-e2fc10a6.json","targetId":"uc:UC-RISK-05","type":"operates"}],"schemaVersion":1}