{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","contextIds":["risk:ai-environmental-footprint","risk:ai-power-concentration-societal","risk:compliance-client-suitability-fiduciary","risk:compliance-improper-market-practices","risk:compliance-regulatory-policy-change","risk:fin-crime-aml-sanctions","risk:fin-icfr-material-weakness","risk:financial-liquidity-capital","risk:fraud-internal-misappropriation","risk:gov-organizational-change-resistance","risk:gov-oversight-failure","risk:gov-policy-absent","risk:gov-weak-internal-control","risk:ops-core-process-inefficiency","risk:ops-counterparty-settlement-disputes","risk:ops-product-service-quality","risk:reputational-brand-crisis","risk:reputational-stakeholder-trust","risk:risk-assessment-inadequate","risk:strategic-concentration"],"directIds":["ctrl:coso-erm:E1","ctrl:coso-erm:E10","ctrl:coso-erm:E11","ctrl:coso-erm:E12","ctrl:coso-erm:E13","ctrl:coso-erm:E14","ctrl:coso-erm:E15","ctrl:coso-erm:E16","ctrl:coso-erm:E17","ctrl:coso-erm:E18","ctrl:coso-erm:E19","ctrl:coso-erm:E2","ctrl:coso-erm:E20","ctrl:coso-erm:E3","ctrl:coso-erm:E4","ctrl:coso-erm:E5","ctrl:coso-erm:E6","ctrl:coso-erm:E7","ctrl:coso-erm:E8","ctrl:coso-erm:E9"],"kind":"bundle","metadata":"/assets/agent_metadata.5c7612c9c5b0b455.json","name":"COSO ERM 2017","next":"/assets/agent_sources-coso-erm-2.dc9723954ade50e3.json","page":1,"pageSize":40,"records":[{"attributes":{"category":"administrative","framework":"coso-erm","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/coso-erm/","description":"Exercises Board Risk Oversight","details":{"automation":"manual","control_category":"administrative","control_id":"E1","control_type":"preventive","domains":["Governance, Policy & Oversight","Human Resources / Personnel Security","Risk Assessment & Management"],"framework":"coso-erm","group":"Governance & Culture","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-coso-erm-e1-2389ffca.html","id":"ctrl:coso-erm:E1","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acoso-erm%3AE1","sourceIds":["coso-erm"],"sourceUrl":null,"title":"E1 — Exercises Board Risk Oversight","type":"control","url":"/assets/agent_record-ctrl-coso-erm-e1-2389ffca.006883516b25c72c.json"},{"attributes":{"category":"administrative","framework":"coso-erm","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/coso-erm/","description":"Identifies Risk","details":{"automation":"manual","control_category":"administrative","control_id":"E10","control_type":"preventive","domains":["Risk Assessment & Management"],"framework":"coso-erm","group":"Performance","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-coso-erm-e10-bc353b03.html","id":"ctrl:coso-erm:E10","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acoso-erm%3AE10","sourceIds":["coso-erm"],"sourceUrl":null,"title":"E10 — Identifies Risk","type":"control","url":"/assets/agent_record-ctrl-coso-erm-e10-bc353b03.f3835487000aefc1.json"},{"attributes":{"category":"administrative","framework":"coso-erm","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/coso-erm/","description":"Assesses Severity of Risk","details":{"automation":"manual","control_category":"administrative","control_id":"E11","control_type":"preventive","domains":["Risk Assessment & Management"],"framework":"coso-erm","group":"Performance","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-coso-erm-e11-1ab45cd8.html","id":"ctrl:coso-erm:E11","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acoso-erm%3AE11","sourceIds":["coso-erm"],"sourceUrl":null,"title":"E11 — Assesses Severity of Risk","type":"control","url":"/assets/agent_record-ctrl-coso-erm-e11-1ab45cd8.d51407d3513c1b70.json"},{"attributes":{"category":"administrative","framework":"coso-erm","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/coso-erm/","description":"Prioritizes Risks","details":{"automation":"manual","control_category":"administrative","control_id":"E12","control_type":"preventive","domains":["Risk Assessment & Management"],"framework":"coso-erm","group":"Performance","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-coso-erm-e12-ec851dae.html","id":"ctrl:coso-erm:E12","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acoso-erm%3AE12","sourceIds":["coso-erm"],"sourceUrl":null,"title":"E12 — Prioritizes Risks","type":"control","url":"/assets/agent_record-ctrl-coso-erm-e12-ec851dae.936b10e5ea227ad4.json"},{"attributes":{"category":"administrative","framework":"coso-erm","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/coso-erm/","description":"Implements Risk Responses","details":{"automation":"manual","control_category":"administrative","control_id":"E13","control_type":"preventive","domains":["Risk Assessment & Management"],"framework":"coso-erm","group":"Performance","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-coso-erm-e13-89e2311d.html","id":"ctrl:coso-erm:E13","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acoso-erm%3AE13","sourceIds":["coso-erm"],"sourceUrl":null,"title":"E13 — Implements Risk Responses","type":"control","url":"/assets/agent_record-ctrl-coso-erm-e13-89e2311d.6492648fa0b65ed1.json"},{"attributes":{"category":"administrative","framework":"coso-erm","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/coso-erm/","description":"Develops Portfolio View","details":{"automation":"manual","control_category":"administrative","control_id":"E14","control_type":"preventive","domains":["Risk Assessment & Management"],"framework":"coso-erm","group":"Performance","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-coso-erm-e14-68b8e783.html","id":"ctrl:coso-erm:E14","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acoso-erm%3AE14","sourceIds":["coso-erm"],"sourceUrl":null,"title":"E14 — Develops Portfolio View","type":"control","url":"/assets/agent_record-ctrl-coso-erm-e14-68b8e783.e84cfe480e180976.json"},{"attributes":{"category":"administrative","framework":"coso-erm","type":"detective"},"canonicalUrl":"https://controlsmap.com/frameworks/coso-erm/","description":"Assesses Substantial Change","details":{"automation":"manual","control_category":"administrative","control_id":"E15","control_type":"detective","domains":["Risk Assessment & Management","Compliance, Audit & Assurance","Governance, Policy & Oversight"],"framework":"coso-erm","group":"Review & Revision","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":4,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-coso-erm-e15-7207b4fa.html","id":"ctrl:coso-erm:E15","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acoso-erm%3AE15","sourceIds":["coso-erm"],"sourceUrl":null,"title":"E15 — Assesses Substantial Change","type":"control","url":"/assets/agent_record-ctrl-coso-erm-e15-7207b4fa.105d0e569f4c2702.json"},{"attributes":{"category":"administrative","framework":"coso-erm","type":"detective"},"canonicalUrl":"https://controlsmap.com/frameworks/coso-erm/","description":"Reviews Risk and Performance","details":{"automation":"manual","control_category":"administrative","control_id":"E16","control_type":"detective","domains":["Risk Assessment & Management","Compliance, Audit & Assurance","Governance, Policy & Oversight"],"framework":"coso-erm","group":"Review & Revision","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-coso-erm-e16-31120406.html","id":"ctrl:coso-erm:E16","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acoso-erm%3AE16","sourceIds":["coso-erm"],"sourceUrl":null,"title":"E16 — Reviews Risk and Performance","type":"control","url":"/assets/agent_record-ctrl-coso-erm-e16-31120406.76d6e8efcb806f40.json"},{"attributes":{"category":"administrative","framework":"coso-erm","type":"corrective"},"canonicalUrl":"https://controlsmap.com/frameworks/coso-erm/","description":"Pursues Improvement in Enterprise Risk Management","details":{"automation":"manual","control_category":"administrative","control_id":"E17","control_type":"corrective","domains":["Risk Assessment & Management","Compliance, Audit & Assurance","Governance, Policy & Oversight"],"framework":"coso-erm","group":"Review & Revision","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-coso-erm-e17-b3a68941.html","id":"ctrl:coso-erm:E17","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acoso-erm%3AE17","sourceIds":["coso-erm"],"sourceUrl":null,"title":"E17 — Pursues Improvement in Enterprise Risk Management","type":"control","url":"/assets/agent_record-ctrl-coso-erm-e17-b3a68941.9d669399f5354342.json"},{"attributes":{"category":"administrative","framework":"coso-erm","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/coso-erm/","description":"Leverages Information and Technology","details":{"automation":"manual","control_category":"administrative","control_id":"E18","control_type":"preventive","domains":["Governance, Policy & Oversight","Compliance, Audit & Assurance","Risk Assessment & Management"],"framework":"coso-erm","group":"Information, Communication & Reporting","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-coso-erm-e18-6386e41e.html","id":"ctrl:coso-erm:E18","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acoso-erm%3AE18","sourceIds":["coso-erm"],"sourceUrl":null,"title":"E18 — Leverages Information and Technology","type":"control","url":"/assets/agent_record-ctrl-coso-erm-e18-6386e41e.b7ac5adf7bec701e.json"},{"attributes":{"category":"administrative","framework":"coso-erm","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/coso-erm/","description":"Communicates Risk Information","details":{"automation":"manual","control_category":"administrative","control_id":"E19","control_type":"preventive","domains":["Governance, Policy & Oversight","Compliance, Audit & Assurance","Risk Assessment & Management"],"framework":"coso-erm","group":"Information, Communication & Reporting","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-coso-erm-e19-4985b126.html","id":"ctrl:coso-erm:E19","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acoso-erm%3AE19","sourceIds":["coso-erm"],"sourceUrl":null,"title":"E19 — Communicates Risk Information","type":"control","url":"/assets/agent_record-ctrl-coso-erm-e19-4985b126.48aad847bd2fdda5.json"},{"attributes":{"category":"administrative","framework":"coso-erm","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/coso-erm/","description":"Establishes Operating Structures","details":{"automation":"manual","control_category":"administrative","control_id":"E2","control_type":"preventive","domains":["Governance, Policy & Oversight","Human Resources / Personnel Security","Risk Assessment & Management"],"framework":"coso-erm","group":"Governance & Culture","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-coso-erm-e2-e2ec476e.html","id":"ctrl:coso-erm:E2","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acoso-erm%3AE2","sourceIds":["coso-erm"],"sourceUrl":null,"title":"E2 — Establishes Operating Structures","type":"control","url":"/assets/agent_record-ctrl-coso-erm-e2-e2ec476e.2fd0691cc6e84308.json"},{"attributes":{"category":"administrative","framework":"coso-erm","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/coso-erm/","description":"Reports on Risk, Culture, and Performance","details":{"automation":"manual","control_category":"administrative","control_id":"E20","control_type":"preventive","domains":["Governance, Policy & Oversight","Compliance, Audit & Assurance","Risk Assessment & Management"],"framework":"coso-erm","group":"Information, Communication & Reporting","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-coso-erm-e20-5b937dac.html","id":"ctrl:coso-erm:E20","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acoso-erm%3AE20","sourceIds":["coso-erm"],"sourceUrl":null,"title":"E20 — Reports on Risk, Culture, and Performance","type":"control","url":"/assets/agent_record-ctrl-coso-erm-e20-5b937dac.fa8d1533bb79847a.json"},{"attributes":{"category":"administrative","framework":"coso-erm","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/coso-erm/","description":"Defines Desired Culture","details":{"automation":"manual","control_category":"administrative","control_id":"E3","control_type":"preventive","domains":["Governance, Policy & Oversight","Human Resources / Personnel Security","Risk Assessment & Management"],"framework":"coso-erm","group":"Governance & Culture","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":5,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-coso-erm-e3-2d76e2c2.html","id":"ctrl:coso-erm:E3","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acoso-erm%3AE3","sourceIds":["coso-erm"],"sourceUrl":null,"title":"E3 — Defines Desired Culture","type":"control","url":"/assets/agent_record-ctrl-coso-erm-e3-2d76e2c2.40fac780258fe732.json"},{"attributes":{"category":"administrative","framework":"coso-erm","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/coso-erm/","description":"Demonstrates Commitment to Core Values","details":{"automation":"manual","control_category":"administrative","control_id":"E4","control_type":"preventive","domains":["Governance, Policy & Oversight","Human Resources / Personnel Security","Risk Assessment & Management"],"framework":"coso-erm","group":"Governance & Culture","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":5,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-coso-erm-e4-97e5f081.html","id":"ctrl:coso-erm:E4","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acoso-erm%3AE4","sourceIds":["coso-erm"],"sourceUrl":null,"title":"E4 — Demonstrates Commitment to Core Values","type":"control","url":"/assets/agent_record-ctrl-coso-erm-e4-97e5f081.d480e74ba4c06612.json"},{"attributes":{"category":"administrative","framework":"coso-erm","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/coso-erm/","description":"Attracts, Develops, and Retains Capable Individuals","details":{"automation":"manual","control_category":"administrative","control_id":"E5","control_type":"preventive","domains":["Governance, Policy & Oversight","Human Resources / Personnel Security","Risk Assessment & Management"],"framework":"coso-erm","group":"Governance & Culture","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-coso-erm-e5-9038c819.html","id":"ctrl:coso-erm:E5","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acoso-erm%3AE5","sourceIds":["coso-erm"],"sourceUrl":null,"title":"E5 — Attracts, Develops, and Retains Capable Individuals","type":"control","url":"/assets/agent_record-ctrl-coso-erm-e5-9038c819.e36d29a87b5578a9.json"},{"attributes":{"category":"administrative","framework":"coso-erm","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/coso-erm/","description":"Analyzes Business Context","details":{"automation":"manual","control_category":"administrative","control_id":"E6","control_type":"preventive","domains":["Governance, Policy & Oversight","Risk Assessment & Management"],"framework":"coso-erm","group":"Strategy & Objective-Setting","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-coso-erm-e6-bd22ee90.html","id":"ctrl:coso-erm:E6","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acoso-erm%3AE6","sourceIds":["coso-erm"],"sourceUrl":null,"title":"E6 — Analyzes Business Context","type":"control","url":"/assets/agent_record-ctrl-coso-erm-e6-bd22ee90.f7ce4951d124fb58.json"},{"attributes":{"category":"administrative","framework":"coso-erm","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/coso-erm/","description":"Defines Risk Appetite","details":{"automation":"manual","control_category":"administrative","control_id":"E7","control_type":"preventive","domains":["Governance, Policy & Oversight","Risk Assessment & Management"],"framework":"coso-erm","group":"Strategy & Objective-Setting","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-coso-erm-e7-a3229c35.html","id":"ctrl:coso-erm:E7","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acoso-erm%3AE7","sourceIds":["coso-erm"],"sourceUrl":null,"title":"E7 — Defines Risk Appetite","type":"control","url":"/assets/agent_record-ctrl-coso-erm-e7-a3229c35.32c2b53a9e8c6636.json"},{"attributes":{"category":"administrative","framework":"coso-erm","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/coso-erm/","description":"Evaluates Alternative Strategies","details":{"automation":"manual","control_category":"administrative","control_id":"E8","control_type":"preventive","domains":["Governance, Policy & Oversight","Risk Assessment & Management"],"framework":"coso-erm","group":"Strategy & Objective-Setting","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-coso-erm-e8-a07b32ad.html","id":"ctrl:coso-erm:E8","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acoso-erm%3AE8","sourceIds":["coso-erm"],"sourceUrl":null,"title":"E8 — Evaluates Alternative Strategies","type":"control","url":"/assets/agent_record-ctrl-coso-erm-e8-a07b32ad.6cb8f55ba8440180.json"},{"attributes":{"category":"administrative","framework":"coso-erm","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/coso-erm/","description":"Formulates Business Objectives","details":{"automation":"manual","control_category":"administrative","control_id":"E9","control_type":"preventive","domains":["Governance, Policy & Oversight","Risk Assessment & Management"],"framework":"coso-erm","group":"Strategy & Objective-Setting","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-coso-erm-e9-9633a103.html","id":"ctrl:coso-erm:E9","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acoso-erm%3AE9","sourceIds":["coso-erm"],"sourceUrl":null,"title":"E9 — Formulates Business Objectives","type":"control","url":"/assets/agent_record-ctrl-coso-erm-e9-9633a103.5dd5e361b689f32f.json"},{"attributes":{"category":"esg","domain":["AI Governance","Risk Assessment & Management"],"inherent_rating":"low","taxonomy":["iso-23894-ai-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Aai-environmental-footprint","description":"Training and large-scale inference consume disproportionate energy and generate greenhouse-gas emissions; rapid AI-hardware obsolescence produces e-waste and pressures critical-mineral supply chains, with environmental and geopolitical risk.","details":{"category":"esg","impact":"low","inherent_rating":"low","likelihood":"medium","risk_id":"ai-environmental-footprint","taxonomies":["iso-23894-ai-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-ai-environmental-footprint-c86cf6c9.html","id":"risk:ai-environmental-footprint","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Aai-environmental-footprint","sourceIds":["coso-erm","iso-31000","iso-42001","soc2"],"sourceUrl":null,"title":"Environmental footprint of AI training and infrastructure","type":"risk","url":"/assets/agent_record-risk-ai-environmental-footprint-c86cf6c9.e6981d3947bdb227.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Risk Assessment & Management"],"inherent_rating":"medium","taxonomy":["nist-ai-rmf-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Aai-power-concentration-societal","description":"Disproportionate access to data, compute, and AI talent creates winner-take-all dynamics foreclosing competition; proliferation of AI-generated synthetic media and automated influence operations degrades the shared epistemic environment and democratic institutions.","details":{"category":"ai_governance","impact":"medium","inherent_rating":"medium","likelihood":"medium","risk_id":"ai-power-concentration-societal","taxonomies":["nist-ai-rmf-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-ai-power-concentration-societal-473c979a.html","id":"risk:ai-power-concentration-societal","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Aai-power-concentration-societal","sourceIds":["aiuc-1","coso-erm","eu-ai-act","iso-31000","iso-42001","nist-csf-2"],"sourceUrl":null,"title":"AI power concentration and erosion of societal trust","type":"risk","url":"/assets/agent_record-risk-ai-power-concentration-societal-473c979a.8ad0af7004f690ff.json"},{"attributes":{"category":"compliance_regulatory","domain":["Compliance, Audit & Assurance","Risk Assessment & Management"],"inherent_rating":"medium","taxonomy":["basel-operational-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Acompliance-client-suitability-fiduciary","description":"Recommending unsuitable products, failing to disclose conflicts of interest, breaching fiduciary duty, KYC failures, inadequate disclosure of fees/risks, negligent advisory activities, and product flaws causing systematic customer harm.","details":{"category":"compliance_regulatory","impact":"medium","inherent_rating":"medium","likelihood":"medium","risk_id":"compliance-client-suitability-fiduciary","taxonomies":["basel-operational-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-compliance-client-suitability-fiduciary-2212ad74.html","id":"risk:compliance-client-suitability-fiduciary","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Acompliance-client-suitability-fiduciary","sourceIds":["coso-erm","iso-31000","nist-800-53","nist-csf-2"],"sourceUrl":null,"title":"Client suitability, disclosure and fiduciary breaches","type":"risk","url":"/assets/agent_record-risk-compliance-client-suitability-fiduciary-2212ad74.f407e637f9925b75.json"},{"attributes":{"category":"compliance_regulatory","domain":["Compliance, Audit & Assurance","Governance, Policy & Oversight"],"inherent_rating":"high","taxonomy":["basel-operational-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Acompliance-improper-market-practices","description":"Losses from antitrust violations, market manipulation (spoofing, layering, front-running), benchmark/rate rigging, unlicensed business activity, and sanctions/export-control violations in the conduct of business.","details":{"category":"compliance_regulatory","impact":"high","inherent_rating":"high","likelihood":"low","risk_id":"compliance-improper-market-practices","taxonomies":["basel-operational-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-compliance-improper-market-practices-9c55cfe9.html","id":"risk:compliance-improper-market-practices","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Acompliance-improper-market-practices","sourceIds":["cobit-2019","coso-erm","iso-27001","nis2","nist-800-53","nist-csf-2"],"sourceUrl":null,"title":"Improper business or market practices","type":"risk","url":"/assets/agent_record-risk-compliance-improper-market-practices-9c55cfe9.1a777f734f0a201c.json"},{"attributes":{"category":"compliance_regulatory","domain":["Compliance, Audit & Assurance","Risk Assessment & Management"],"inherent_rating":"medium","taxonomy":["coso-erm-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Acompliance-regulatory-policy-change","description":"Changes in law, regulation, tax policy, or government programs materially alter the entity’s cost structure, competitive dynamics, or permissible business practices, requiring costly adaptation.","details":{"category":"compliance_regulatory","impact":"medium","inherent_rating":"medium","likelihood":"medium","risk_id":"compliance-regulatory-policy-change","taxonomies":["coso-erm-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-compliance-regulatory-policy-change-9429f25b.html","id":"risk:compliance-regulatory-policy-change","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Acompliance-regulatory-policy-change","sourceIds":["cobit-2019","coso-erm","coso-ic","iso-27001","iso-31000","soc2"],"sourceUrl":null,"title":"Adverse regulatory or policy change","type":"risk","url":"/assets/agent_record-risk-compliance-regulatory-policy-change-9429f25b.c922efc13b75a562.json"},{"attributes":{"category":"compliance_regulatory","domain":["Compliance, Audit & Assurance","Risk Assessment & Management","Governance, Policy & Oversight"],"inherent_rating":"high","taxonomy":["enterprise-risk","basel-operational-risk","coso-erm-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Afin-crime-aml-sanctions","description":"Failure to prevent money laundering or terrorist financing, file SARs/CTRs, perform adequate KYC/beneficial-ownership due diligence, screen for PEPs, or avoid processing transactions for OFAC-sanctioned parties; BSA/AML program deficiencies.","details":{"category":"compliance_regulatory","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"fin-crime-aml-sanctions","taxonomies":["enterprise-risk","basel-operational-risk","coso-erm-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-fin-crime-aml-sanctions-80b15201.html","id":"risk:fin-crime-aml-sanctions","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Afin-crime-aml-sanctions","sourceIds":["cobit-2019","coso-erm","coso-ic","iso-31000","nist-csf-2","soc2"],"sourceUrl":null,"title":"Money laundering, sanctions and financial-crime program failures","type":"risk","url":"/assets/agent_record-risk-fin-crime-aml-sanctions-80b15201.3441cdfac714d353.json"},{"attributes":{"category":"financial_reporting","domain":["Financial Reporting Controls (SOX)","Compliance, Audit & Assurance","Governance, Policy & Oversight"],"inherent_rating":"critical","taxonomy":["enterprise-risk","coso-erm-risk","sox-rmm-assertion"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Afin-icfr-material-weakness","description":"Because internal control over financial reporting is not maintained effectively - material weaknesses undetected or undisclosed and certifications signed despite known deficiencies - financial statements may be materially misstated and filings delayed or restated, resulting in SEC enforcement, delisting, securities-fraud liability, and loss of investor confidence.","details":{"category":"financial_reporting","impact":"critical","inherent_rating":"critical","likelihood":"medium","risk_id":"fin-icfr-material-weakness","taxonomies":["enterprise-risk","coso-erm-risk","sox-rmm-assertion"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-fin-icfr-material-weakness-cdd66323.html","id":"risk:fin-icfr-material-weakness","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Afin-icfr-material-weakness","sourceIds":["cobit-2019","coso-erm","coso-ic","iia-2024","iso-27001","nis2","nist-800-53","nist-csf-2","soc2","sox"],"sourceUrl":null,"title":"Ineffective ICFR / undisclosed material weakness","type":"risk","url":"/assets/agent_record-risk-fin-icfr-material-weakness-cdd66323.c752785baa39846a.json"},{"attributes":{"category":"financial","domain":["Risk Assessment & Management"],"inherent_rating":"high","taxonomy":["enterprise-risk","coso-erm-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Afinancial-liquidity-capital","description":"Cash-flow shortfall from working-capital deterioration, covenant breaches accelerating debt, loss of revolving credit, or capital-market disruption; debt maturity walls and downgrades limiting refinancing at acceptable terms; insufficient capital to absorb losses.","details":{"category":"financial","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"financial-liquidity-capital","taxonomies":["enterprise-risk","coso-erm-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-financial-liquidity-capital-e0ac2d24.html","id":"risk:financial-liquidity-capital","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Afinancial-liquidity-capital","sourceIds":["coso-erm","coso-ic","iso-31000","nist-800-53","nist-csf-2","nydfs-500","soc2","sox"],"sourceUrl":null,"title":"Liquidity, capital-structure and refinancing risk","type":"risk","url":"/assets/agent_record-risk-financial-liquidity-capital-e0ac2d24.0f938fc816181917.json"},{"attributes":{"category":"operational","domain":["Governance, Policy & Oversight","Financial Reporting Controls (SOX)","Risk Assessment & Management"],"inherent_rating":"high","taxonomy":["basel-operational-risk","coso-erm-risk","sox-rmm-assertion"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Afraud-internal-misappropriation","description":"Employees defraud the entity for financial gain: embezzlement or theft of company/client funds, fraudulent expense/payroll claims, forgery to obtain unauthorized disbursements, bribery/kickback schemes, insider trading on own account, and wilful tax evasion.","details":{"category":"operational","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"fraud-internal-misappropriation","taxonomies":["basel-operational-risk","coso-erm-risk","sox-rmm-assertion"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-fraud-internal-misappropriation-d235cd10.html","id":"risk:fraud-internal-misappropriation","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Afraud-internal-misappropriation","sourceIds":["coso-erm","coso-ic","iso-27001","nis2","nist-800-53","nist-csf-2","soc2","sox"],"sourceUrl":null,"title":"Internal fraud — asset misappropriation, embezzlement, forgery","type":"risk","url":"/assets/agent_record-risk-fraud-internal-misappropriation-d235cd10.340e455cacc8708f.json"},{"attributes":{"category":"operational","domain":["Human Resources / Personnel Security","Governance, Policy & Oversight"],"inherent_rating":"medium","taxonomy":["coso-erm-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Agov-organizational-change-resistance","description":"Significant structural or cultural change (restructuring, ERP/digital transformation) causes employee resistance, productivity loss, or talent departures that undermine the entity’s capacity to adapt to strategic imperatives.","details":{"category":"operational","impact":"medium","inherent_rating":"medium","likelihood":"medium","risk_id":"gov-organizational-change-resistance","taxonomies":["coso-erm-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-gov-organizational-change-resistance-a8383ccb.html","id":"risk:gov-organizational-change-resistance","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Agov-organizational-change-resistance","sourceIds":["cobit-2019","coso-erm","coso-ic","nist-800-53","nydfs-500"],"sourceUrl":null,"title":"Organizational change and transformation failure","type":"risk","url":"/assets/agent_record-risk-gov-organizational-change-resistance-a8383ccb.a2e8f3631e7bd023.json"},{"attributes":{"category":"strategic","domain":["Governance, Policy & Oversight","Compliance, Audit & Assurance"],"inherent_rating":"high","taxonomy":["coso-erm-risk","iso-27005-vulnerability"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Agov-oversight-failure","description":"Because board and management oversight of risk and control is weak - unclear tone at the top, ineffective board composition or independence, poor committee structure, and limited senior-management commitment - control priorities are not enforced and resources are withheld, so risks accumulate unmanaged and control failures go uncorrected across the entity.","details":{"category":"strategic","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"gov-oversight-failure","taxonomies":["coso-erm-risk","iso-27005-vulnerability"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-gov-oversight-failure-d98ffc12.html","id":"risk:gov-oversight-failure","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Agov-oversight-failure","sourceIds":["cobit-2019","coso-erm","coso-ic","iia-2024","iia-pos-2026-erm","nis2","nist-csf-2","soc2","sox"],"sourceUrl":null,"title":"Inadequate board and management oversight of risk and control","type":"risk","url":"/assets/agent_record-risk-gov-oversight-failure-d98ffc12.e05fa5d3e4686a7a.json"},{"attributes":{"category":"compliance_regulatory","domain":["Governance, Policy & Oversight","Data Protection & Privacy"],"inherent_rating":"medium","taxonomy":["iso-27005-vulnerability","nist-privacy-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Agov-policy-absent","description":"Because documented, approved, and enforced security and privacy policies are missing and roles and duties are undefined, personnel operate without guidance on required controls and behaviours, so controls are applied inconsistently and accountability gaps leave violations undetected and unaddressed.","details":{"category":"compliance_regulatory","impact":"medium","inherent_rating":"medium","likelihood":"medium","risk_id":"gov-policy-absent","taxonomies":["iso-27005-vulnerability","nist-privacy-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-gov-policy-absent-cf76dbbf.html","id":"risk:gov-policy-absent","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Agov-policy-absent","sourceIds":["cobit-2019","coso-erm","coso-ic","gdpr","hipaa","iso-27001","nis2","nist-800-53","nist-csf-2","nydfs-500","pci-dss","soc2"],"sourceUrl":null,"title":"Missing or insufficient security and privacy policies","type":"risk","url":"/assets/agent_record-risk-gov-policy-absent-cf76dbbf.643fca249d5d0d9c.json"},{"attributes":{"category":"financial_reporting","domain":["Governance, Policy & Oversight","Financial Reporting Controls (SOX)","Compliance, Audit & Assurance"],"inherent_rating":"high","taxonomy":["coso-erm-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Agov-weak-internal-control","description":"Because the internal control environment is weak - segregation of duties absent, authorization frameworks inadequate, and tone at the top poor - fraudulent and erroneous transactions can be initiated and concealed, resulting in material misstatement and financial, regulatory, and reputational loss.","details":{"category":"financial_reporting","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"gov-weak-internal-control","taxonomies":["coso-erm-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-gov-weak-internal-control-7acb9117.html","id":"risk:gov-weak-internal-control","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Agov-weak-internal-control","sourceIds":["cobit-2019","coso-erm","coso-ic","iia-2024","iso-27001","nist-800-53","nist-csf-2","nydfs-500","soc2","sox"],"sourceUrl":null,"title":"Weak internal control environment enabling fraud and error","type":"risk","url":"/assets/agent_record-risk-gov-weak-internal-control-7acb9117.f087c0c22fea9ee2.json"},{"attributes":{"category":"operational","domain":["Risk Assessment & Management","Governance, Policy & Oversight"],"inherent_rating":"medium","taxonomy":["coso-erm-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Aops-core-process-inefficiency","description":"Poorly designed, undocumented, or poorly executed business processes lead to errors, rework, cost overruns, service failures, and inability to scale operations reliably; large change programs fail to deliver benefits on time and budget.","details":{"category":"operational","impact":"medium","inherent_rating":"medium","likelihood":"medium","risk_id":"ops-core-process-inefficiency","taxonomies":["coso-erm-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-ops-core-process-inefficiency-8e830edd.html","id":"risk:ops-core-process-inefficiency","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Aops-core-process-inefficiency","sourceIds":["cobit-2019","coso-erm","coso-ic","iso-27001","nist-800-53","nist-csf-2","soc2"],"sourceUrl":null,"title":"Core process breakdown and inability to scale","type":"risk","url":"/assets/agent_record-risk-ops-core-process-inefficiency-8e830edd.82a1f86e9f846dd7.json"},{"attributes":{"category":"operational","domain":["Risk Assessment & Management"],"inherent_rating":"medium","taxonomy":["basel-operational-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Aops-counterparty-settlement-disputes","description":"Counterparty default on OTC derivatives, settlement disputes with brokers/custodians, failure of a central counterparty, netting/close-out disputes, and margin-call miscalculations cause direct losses.","details":{"category":"operational","impact":"medium","inherent_rating":"medium","likelihood":"low","risk_id":"ops-counterparty-settlement-disputes","taxonomies":["basel-operational-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-ops-counterparty-settlement-disputes-eaf4600f.html","id":"risk:ops-counterparty-settlement-disputes","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Aops-counterparty-settlement-disputes","sourceIds":["coso-erm","iso-31000","nist-800-53","nist-csf-2","soc2"],"sourceUrl":null,"title":"Trade-counterparty performance and settlement disputes","type":"risk","url":"/assets/agent_record-risk-ops-counterparty-settlement-disputes-eaf4600f.d87381a70e53a658.json"},{"attributes":{"category":"operational","domain":["Risk Assessment & Management"],"inherent_rating":"high","taxonomy":["coso-erm-risk","enterprise-risk","basel-operational-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Aops-product-service-quality","description":"Outputs fail to meet specifications, customer requirements, or regulatory standards, leading to recalls, warranty claims, customer attrition, and reputational harm; product-safety incidents generate scrutiny and brand-equity erosion.","details":{"category":"operational","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"ops-product-service-quality","taxonomies":["coso-erm-risk","enterprise-risk","basel-operational-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-ops-product-service-quality-2066b257.html","id":"risk:ops-product-service-quality","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Aops-product-service-quality","sourceIds":["coso-erm","iso-31000","nist-csf-2","soc2"],"sourceUrl":null,"title":"Product and service quality failure","type":"risk","url":"/assets/agent_record-risk-ops-product-service-quality-2066b257.2c15027d0b162c78.json"},{"attributes":{"category":"reputational","domain":["Risk Assessment & Management","Governance, Policy & Oversight"],"inherent_rating":"high","taxonomy":["enterprise-risk","coso-erm-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Areputational-brand-crisis","description":"Product-safety/quality failures, executive misconduct, data breaches, adverse media, or viral social-media/activist campaigns erode customer trust, investor confidence, partnerships, and brand equity — with long-term value loss exceeding near-term financial impact.","details":{"category":"reputational","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"reputational-brand-crisis","taxonomies":["enterprise-risk","coso-erm-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-reputational-brand-crisis-4d7c293d.html","id":"risk:reputational-brand-crisis","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Areputational-brand-crisis","sourceIds":["coso-erm","coso-ic","gdpr","nis2","nist-800-53","nist-csf-2","nydfs-500","soc2","sox"],"sourceUrl":null,"title":"Brand and reputational crisis","type":"risk","url":"/assets/agent_record-risk-reputational-brand-crisis-4d7c293d.ca86d666a4dadafe.json"},{"attributes":{"category":"reputational","domain":["Governance, Policy & Oversight","Risk Assessment & Management"],"inherent_rating":"medium","taxonomy":["coso-erm-risk","enterprise-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Areputational-stakeholder-trust","description":"Gradual loss of trust and social license among customers, employees, investors, regulators, and communities — from perceived values misalignment, poor ESG/governance conduct, or repeated service failures — weakening stakeholder relationships and long-term enterprise value even absent a single acute crisis.","details":{"category":"reputational","impact":"medium","inherent_rating":"medium","likelihood":"medium","risk_id":"reputational-stakeholder-trust","taxonomies":["coso-erm-risk","enterprise-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-reputational-stakeholder-trust-23d21e70.html","id":"risk:reputational-stakeholder-trust","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Areputational-stakeholder-trust","sourceIds":["cobit-2019","coso-erm","coso-ic","gdpr","iia-pos-2026-erm","iia-pos-2026-three-lines","iso-31000","nist-800-53","nist-csf-2","soc2","sox"],"sourceUrl":null,"title":"Stakeholder trust and social-license erosion","type":"risk","url":"/assets/agent_record-risk-reputational-stakeholder-trust-23d21e70.cc84ea3ea3c8507a.json"},{"attributes":{"category":"operational","domain":["Risk Assessment & Management","Governance, Policy & Oversight"],"inherent_rating":"high","taxonomy":["coso-erm-risk","enterprise-risk","nist-privacy-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Arisk-assessment-inadequate","description":"No systematic process to identify, analyse, evaluate, and treat risk — including missing fraud-risk assessment and no ongoing risk monitoring — leaving material exposures unidentified and untreated before they materialise.","details":{"category":"operational","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"risk-assessment-inadequate","taxonomies":["coso-erm-risk","enterprise-risk","nist-privacy-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-risk-assessment-inadequate-328128b5.html","id":"risk:risk-assessment-inadequate","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Arisk-assessment-inadequate","sourceIds":["cobit-2019","coso-erm","coso-ic","eu-ai-act","iso-31000","nist-800-53","nist-csf-2","nydfs-500","soc2","sox"],"sourceUrl":null,"title":"Inadequate or absent risk assessment process","type":"risk","url":"/assets/agent_record-risk-risk-assessment-inadequate-328128b5.d129815d96ef1693.json"},{"attributes":{"category":"strategic","domain":["Risk Assessment & Management"],"inherent_rating":"high","taxonomy":["enterprise-risk","coso-erm-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Astrategic-concentration","description":"Revenue or gross profit concentrated in a single product line, customer, channel, or geography; loss of one major customer or an adverse regulatory change to a dominant product creates existential revenue risk.","details":{"category":"strategic","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"strategic-concentration","taxonomies":["enterprise-risk","coso-erm-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-strategic-concentration-816dfff6.html","id":"risk:strategic-concentration","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Astrategic-concentration","sourceIds":["coso-erm","iso-31000","nist-800-53","nist-csf-2"],"sourceUrl":null,"title":"Product, customer or market concentration","type":"risk","url":"/assets/agent_record-risk-strategic-concentration-816dfff6.b839ccb8f7d1c607.json"}],"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:0257c55716dca223129a372669f7c99b0a7ef23cc5a0d85888ef9d4fbb417ed2","properties":{"control_id":"E2","coverage":"full","delta":null,"framework":"coso-erm","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2017"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-06-f1eb1346.json","sourceId":"uc:UC-GOV-06","targetDetailPath":"/data/v1/records/ctrl-coso-erm-e2-e2ec476e.json","targetId":"ctrl:coso-erm:E2","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:0a0070742580f23a1c2ff349153e822dde9f43340c2779ce29b38fcdac6e6659","properties":{"rationale":"Evaluating and prioritising analyzed risks against criteria to decide treatment is a core process step countering an assessment that never reaches decisions.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-08-5f27bebc.json","sourceId":"uc:UC-RISK-08","targetDetailPath":"/data/v1/records/risk-risk-assessment-inadequate-328128b5.json","targetId":"risk:risk-assessment-inadequate","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:0e873b6b40e4867b0de5f11e642f1de223f340361d7a6d3683082b43e2765895","properties":{"control_id":"E19","coverage":"full","delta":null,"framework":"coso-erm","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2017"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-21-8c5d79f9.json","sourceId":"uc:UC-GOV-21","targetDetailPath":"/data/v1/records/ctrl-coso-erm-e19-4985b126.json","targetId":"ctrl:coso-erm:E19","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:108a3809a1bac8bc7cb9df10dcb04af91bb4cceb5fd8086da8cbfc0011a122c9","properties":{"control_id":"E15","coverage":"full","delta":null,"framework":"coso-erm","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2017"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-11-3f5d23ea.json","sourceId":"uc:UC-RISK-11","targetDetailPath":"/data/v1/records/ctrl-coso-erm-e15-7207b4fa.json","targetId":"ctrl:coso-erm:E15","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:12be2c89e1e9f3b74f3530581699695bd6b9389c77b4aa2abf3bd7684f527054","properties":{"rationale":"","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-06-f1eb1346.json","sourceId":"uc:UC-GOV-06","targetDetailPath":"/data/v1/records/risk-ops-core-process-inefficiency-8e830edd.json","targetId":"risk:ops-core-process-inefficiency","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:13940721273528379e42b729a76ebeba02d11a16bcde14a32426a8a503edeb34","properties":{"control_id":"E8","coverage":"full","delta":null,"framework":"coso-erm","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2017"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-12-5c560a78.json","sourceId":"uc:UC-GOV-12","targetDetailPath":"/data/v1/records/ctrl-coso-erm-e8-a07b32ad.json","targetId":"ctrl:coso-erm:E8","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:15e7e8b4aec292d6fd49396f0d3c00a7942432887ca96c313c2f2d868f6b189b","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-erm-e16-31120406.json","sourceId":"ctrl:coso-erm:E16","targetDetailPath":"/data/v1/records/std-coso-erm-7265cc54.json","targetId":"std:coso-erm","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:180ce223861b332e1e1d5ad983fb57d87f852dbf326eb0e493dd27e918386be6","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-erm-e5-9038c819.json","sourceId":"ctrl:coso-erm:E5","targetDetailPath":"/data/v1/records/std-coso-erm-7265cc54.json","targetId":"std:coso-erm","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:1be4a5446d36fa2ad750bb3f90ff4ee677ebedec3299840fd2763d3847472b32","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-erm-e18-6386e41e.json","sourceId":"ctrl:coso-erm:E18","targetDetailPath":"/data/v1/records/std-coso-erm-7265cc54.json","targetId":"std:coso-erm","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:1c73143ddcb4283a738b8c839870221583e6a39feb3706549dc24d63417bb58a","properties":{"control_id":"E10","coverage":"full","delta":null,"framework":"coso-erm","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2017"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-07-b86de728.json","sourceId":"uc:UC-RISK-07","targetDetailPath":"/data/v1/records/ctrl-coso-erm-e10-bc353b03.json","targetId":"ctrl:coso-erm:E10","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:1df23477753a566da2080fece117db269202f651c0c36a605967cec8558aa896","properties":{"control_id":"E9","coverage":"full","delta":null,"framework":"coso-erm","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2017"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-12-5c560a78.json","sourceId":"uc:UC-GOV-12","targetDetailPath":"/data/v1/records/ctrl-coso-erm-e9-9633a103.json","targetId":"ctrl:coso-erm:E9","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:231c1989392043534ae70b45cf09c27b9dc697ce2c68633883243fdeea4b67e5","properties":{"rationale":"Defining and assigning security roles, responsibilities, and authorities directly remedies undefined roles and duties.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-06-f1eb1346.json","sourceId":"uc:UC-GOV-06","targetDetailPath":"/data/v1/records/risk-gov-policy-absent-cf76dbbf.json","targetId":"risk:gov-policy-absent","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2754750eaaa885c1da8468ff91127cbfa89ad977327a827659f27a030198744b","properties":{"rationale":"A maintained risk register with status and portfolio reporting is the ongoing risk monitoring the risk describes as missing.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-10-6d44f690.json","sourceId":"uc:UC-RISK-10","targetDetailPath":"/data/v1/records/risk-risk-assessment-inadequate-328128b5.json","targetId":"risk:risk-assessment-inadequate","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:29dedf612f5974c39011fefd61d892f6886d62b0af182e6092ad1a2a47a89ede","properties":{"rationale":"","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-08-5f27bebc.json","sourceId":"uc:UC-RISK-08","targetDetailPath":"/data/v1/records/risk-ops-counterparty-settlement-disputes-eaf4600f.json","targetId":"risk:ops-counterparty-settlement-disputes","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2eb3bf860527ae764ceb223797b7c644151e7196d1c96259d91b201567ae61c5","properties":{"rationale":"Monitoring/reviewing the framework's own performance detects process decay, but is meta-monitoring of the program, not the operative assessment steps; ongoing risk monitoring itself sits in the register/reassessment controls.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-13-75b9f6c7.json","sourceId":"uc:UC-RISK-13","targetDetailPath":"/data/v1/records/risk-risk-assessment-inadequate-328128b5.json","targetId":"risk:risk-assessment-inadequate","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:301e35f4f0c71b54ab2bebf37b762c44e4373f1ce97bfd2ec5cbfe0bb8cda212","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-erm-e4-97e5f081.json","sourceId":"ctrl:coso-erm:E4","targetDetailPath":"/data/v1/records/std-coso-erm-7265cc54.json","targetId":"std:coso-erm","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:3270acd877664b49d9afe4306dd9b608118e56b620865bbdca0676d9bca84a26","properties":{"control_id":"E5","coverage":"full","delta":null,"framework":"coso-erm","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2017"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-10-016614d1.json","sourceId":"uc:UC-GOV-10","targetDetailPath":"/data/v1/records/ctrl-coso-erm-e5-9038c819.json","targetId":"ctrl:coso-erm:E5","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:35462772fde081a71d83ba24bd6b33c670aad58d703256fb69ccd4e7f808fcb4","properties":{"control_id":"E11","coverage":"full","delta":null,"framework":"coso-erm","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2017"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-07-b86de728.json","sourceId":"uc:UC-RISK-07","targetDetailPath":"/data/v1/records/ctrl-coso-erm-e11-1ab45cd8.json","targetId":"ctrl:coso-erm:E11","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:35469ce4cb671182840373ba75e324ed800a0a4e4d47d09d3d1e037f6d10f617","properties":{"control_id":"E1","coverage":"full","delta":null,"framework":"coso-erm","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2017"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-05-b3a47944.json","sourceId":"uc:UC-GOV-05","targetDetailPath":"/data/v1/records/ctrl-coso-erm-e1-2389ffca.json","targetId":"ctrl:coso-erm:E1","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:38356248cfe15a2821b2a07828be9a210480af0f7a1069af8fbf8fa90248e6c4","properties":{"rationale":"","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-07-b86de728.json","sourceId":"uc:UC-RISK-07","targetDetailPath":"/data/v1/records/risk-fin-crime-aml-sanctions-80b15201.json","targetId":"risk:fin-crime-aml-sanctions","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:397d6a9f3645df04d18f6a044b7452585127fcb92a1842f5296ddf5b911c9ec1","properties":{"control_id":"E16","coverage":"full","delta":null,"framework":"coso-erm","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2017"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-13-75b9f6c7.json","sourceId":"uc:UC-RISK-13","targetDetailPath":"/data/v1/records/ctrl-coso-erm-e16-31120406.json","targetId":"ctrl:coso-erm:E16","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:3a0f2e69c088ac34e68a1248331a1aa1dab5e336e298d9773e3a5d33693336b7","properties":{"rationale":"Establishing the risk-assessment policy, methodology, appetite, and process directly remedies an absent or inadequate risk-assessment process.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-17-5ee3266f.json","sourceId":"uc:UC-GOV-17","targetDetailPath":"/data/v1/records/risk-risk-assessment-inadequate-328128b5.json","targetId":"risk:risk-assessment-inadequate","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:3f20ac84d57f6fc3147a14ecb7f441b37893c6231eb7e5cfe210b41db70ae38c","properties":{"rationale":"Tone at the top, ethics, and an adopted code of conduct are the control-environment foundation the risk names as poor.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-04-849a3e91.json","sourceId":"uc:UC-GOV-04","targetDetailPath":"/data/v1/records/risk-gov-weak-internal-control-7acb9117.json","targetId":"risk:gov-weak-internal-control","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:42a4d9394bb6b7ca626460c5d5e8995f3cbb8b1ac9f75e91b807e40976ac6d0a","properties":{"rationale":"","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-09-06ffdff1.json","sourceId":"uc:UC-RISK-09","targetDetailPath":"/data/v1/records/risk-financial-liquidity-capital-e0ac2d24.json","targetId":"risk:financial-liquidity-capital","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:4b17855269bbd4488104aa2c7cfbd789f2636af703e79e9f6f2717babac70a27","properties":{"control_id":"E6","coverage":"full","delta":null,"framework":"coso-erm","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2017"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-02-70e0507c.json","sourceId":"uc:UC-GOV-02","targetDetailPath":"/data/v1/records/ctrl-coso-erm-e6-bd22ee90.json","targetId":"ctrl:coso-erm:E6","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:4efa7d9e4b72a7a5cb24975d635877780620644632caa229ee42ad89a0c6db3a","properties":{"rationale":"Demonstrated integrity and core values counter the perceived values-misalignment that erodes stakeholder trust.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-04-849a3e91.json","sourceId":"uc:UC-GOV-04","targetDetailPath":"/data/v1/records/risk-reputational-stakeholder-trust-23d21e70.json","targetId":"risk:reputational-stakeholder-trust","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:4fbd0e215c1b15c1eb800748ac761da0d2bf0dde577c169240443ff9cdc16c9f","properties":{"rationale":"Reporting to external stakeholders on risk and performance sustains stakeholder relationships and trust.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-21-8c5d79f9.json","sourceId":"uc:UC-GOV-21","targetDetailPath":"/data/v1/records/risk-reputational-stakeholder-trust-23d21e70.json","targetId":"risk:reputational-stakeholder-trust","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:51bad5a1784a763c1e268a12319e2469c028207190509ebf9976c2c5ac8117f9","properties":{"rationale":"","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-09-06ffdff1.json","sourceId":"uc:UC-RISK-09","targetDetailPath":"/data/v1/records/risk-compliance-client-suitability-fiduciary-2212ad74.json","targetId":"risk:compliance-client-suitability-fiduciary","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:5281390054b41163d7d644d1c520e88598f1a899f13fd5818c8d8839e14fa9c3","properties":{"rationale":"Board independence, expertise, and oversight of the control and risk program is the direct control against inadequate board oversight.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-05-b3a47944.json","sourceId":"uc:UC-GOV-05","targetDetailPath":"/data/v1/records/risk-gov-oversight-failure-d98ffc12.json","targetId":"risk:gov-oversight-failure","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:534c8d98a58d9a5e55336b56dea75b05990b462c31487f1ed2242dcc39e26d21","properties":{"rationale":"Systematic risk identification and likelihood/impact analysis with consistent severity scales is the analytic core of the risk-assessment process.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-07-b86de728.json","sourceId":"uc:UC-RISK-07","targetDetailPath":"/data/v1/records/risk-risk-assessment-inadequate-328128b5.json","targetId":"risk:risk-assessment-inadequate","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:558adde8cd415d2e733e3c9beea91602c15ef57f824a06d14b007ceb62505c6c","properties":{"control_id":"E18","coverage":"full","delta":null,"framework":"coso-erm","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2017"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-21-8c5d79f9.json","sourceId":"uc:UC-GOV-21","targetDetailPath":"/data/v1/records/ctrl-coso-erm-e18-6386e41e.json","targetId":"ctrl:coso-erm:E18","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:55d98f71337b6a07fdde1ba619995d8b78c179bbbb0d05e658965b71a4099f89","properties":{"rationale":"Leadership demonstrating integrity and a risk-aware culture directly addresses the unclear tone at the top driving oversight failure.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-04-849a3e91.json","sourceId":"uc:UC-GOV-04","targetDetailPath":"/data/v1/records/risk-gov-oversight-failure-d98ffc12.json","targetId":"risk:gov-oversight-failure","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:562ed1f4d761bf88a5acd404fdeb05426f0e1d6b92c82f1e669169ae5d60bb92","properties":{"rationale":"","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-15-e01fb134.json","sourceId":"uc:UC-RISK-15","targetDetailPath":"/data/v1/records/risk-ai-power-concentration-societal-473c979a.json","targetId":"risk:ai-power-concentration-societal","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:638ab94765d0a75186b8cdd1796600dc3e3548804af16ad3f6dc9026f02ba644","properties":{"rationale":"Identifying stakeholder needs and expectations lets the organization meet them, sustaining trust.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-02-70e0507c.json","sourceId":"uc:UC-GOV-02","targetDetailPath":"/data/v1/records/risk-reputational-stakeholder-trust-23d21e70.json","targetId":"risk:reputational-stakeholder-trust","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:63ebbbc35c597cf5bba4e4837a4cc9c058bcb3a4ba923205f09d8b39c4d950f0","properties":{"rationale":"An ethical culture, code of conduct, and disciplinary follow-through deter the rationalization leg of insider fraud.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-04-849a3e91.json","sourceId":"uc:UC-GOV-04","targetDetailPath":"/data/v1/records/risk-fraud-internal-misappropriation-d235cd10.json","targetId":"risk:fraud-internal-misappropriation","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:640260653bf795156b6a67f22b0d8a0888a43f87958b1b50b8009482e7a29bc0","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-erm-e7-a3229c35.json","sourceId":"ctrl:coso-erm:E7","targetDetailPath":"/data/v1/records/std-coso-erm-7265cc54.json","targetId":"std:coso-erm","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:651fa14d824ac24603ef59f315f47e53dbcbdb929659ca3e1e07d2d62152e34a","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-erm-e11-1ab45cd8.json","sourceId":"ctrl:coso-erm:E11","targetDetailPath":"/data/v1/records/std-coso-erm-7265cc54.json","targetId":"std:coso-erm","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:65c095cf3ce978ff7a07fc0cb45cf636cf2fc931ce86429df16da655bc187122","properties":{"rationale":"Consistent ethical leadership behavior reduces executive-misconduct triggers of brand crises.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-04-849a3e91.json","sourceId":"uc:UC-GOV-04","targetDetailPath":"/data/v1/records/risk-reputational-brand-crisis-4d7c293d.json","targetId":"risk:reputational-brand-crisis","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:6f2b9aa0a72e0fb291a86dc5a96231aa3ac10af6f2b82e67665e5581d5ac415f","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-erm-e17-b3a68941.json","sourceId":"ctrl:coso-erm:E17","targetDetailPath":"/data/v1/records/std-coso-erm-7265cc54.json","targetId":"std:coso-erm","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7559d0ca4657fd1e817f539117d4e5d7f00bd68021be5ae88b2cc7d9e7389af0","properties":{"rationale":"","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-17-5ee3266f.json","sourceId":"uc:UC-GOV-17","targetDetailPath":"/data/v1/records/risk-compliance-improper-market-practices-9c55cfe9.json","targetId":"risk:compliance-improper-market-practices","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7955b1b9fa047a0492a763f43d53011ae30ae41757addefe26ff91d2b795c4c8","properties":{"rationale":"","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-07-b86de728.json","sourceId":"uc:UC-RISK-07","targetDetailPath":"/data/v1/records/risk-strategic-concentration-816dfff6.json","targetId":"risk:strategic-concentration","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7b987e2457e3123d2ab502637159c47dbd0be45ceb05c4e95eff9095762ad1b8","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-erm-e14-68b8e783.json","sourceId":"ctrl:coso-erm:E14","targetDetailPath":"/data/v1/records/std-coso-erm-7265cc54.json","targetId":"std:coso-erm","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:81b183c354110d23bb4f0279df5612d5d53707b19186b9b578d40919ad58e69f","properties":{"control_id":"E7","coverage":"full","delta":null,"framework":"coso-erm","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2017"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-17-5ee3266f.json","sourceId":"uc:UC-GOV-17","targetDetailPath":"/data/v1/records/ctrl-coso-erm-e7-a3229c35.json","targetId":"ctrl:coso-erm:E7","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:90878588df00f7d57db2d579ea31b5def525f8d552d2053df6dcd6a98660c2f3","properties":{"rationale":"Control explicitly assesses regulatory changes for risk impact; early detection of adverse law/policy change enables timely, less costly adaptation.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-11-3f5d23ea.json","sourceId":"uc:UC-RISK-11","targetDetailPath":"/data/v1/records/risk-compliance-regulatory-policy-change-9429f25b.json","targetId":"risk:compliance-regulatory-policy-change","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:92a1b157ab9b00219588bf46b2b9c083569dd0b81a311ba8313880fabd8bc823","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-erm-e19-4985b126.json","sourceId":"ctrl:coso-erm:E19","targetDetailPath":"/data/v1/records/std-coso-erm-7265cc54.json","targetId":"std:coso-erm","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:935d25bbef8454b444f68db385cb6e210fc2d4b103b236f99a07c9d1c8a30824","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-erm-e13-89e2311d.json","sourceId":"ctrl:coso-erm:E13","targetDetailPath":"/data/v1/records/std-coso-erm-7265cc54.json","targetId":"std:coso-erm","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9b2ce9e03e035815e780353e25159299363bde25a0e1c67c04e745ce93ad0732","properties":{"control_id":"E20","coverage":"full","delta":null,"framework":"coso-erm","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2017"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-21-8c5d79f9.json","sourceId":"uc:UC-GOV-21","targetDetailPath":"/data/v1/records/ctrl-coso-erm-e20-5b937dac.json","targetId":"ctrl:coso-erm:E20","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9e1dd44af111fe5210a4caf943b2f11f00f4a341bdf3149dbca73e398823c219","properties":{"rationale":"Continually improving the framework from lessons sustains the process's suitability over time, but acts on the program rather than operating the assessment steps; a second-order contributor to sustained adequacy, not operative defense.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-15-e01fb134.json","sourceId":"uc:UC-RISK-15","targetDetailPath":"/data/v1/records/risk-risk-assessment-inadequate-328128b5.json","targetId":"risk:risk-assessment-inadequate","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9e6b3b8a1912c976324fe5bd2318d04b639939c5f0df1ce0587fbfbe77fc6b3b","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-erm-e10-bc353b03.json","sourceId":"ctrl:coso-erm:E10","targetDetailPath":"/data/v1/records/std-coso-erm-7265cc54.json","targetId":"std:coso-erm","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a21077e4bec07cc3fa7adc371c05d84839954ae452369ee04848bc2a464af6ed","properties":{"rationale":"Selecting, planning and tracking risk treatments to residual-risk re-evaluation is the treat stage; operating it stops exposures being left untreated.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-09-06ffdff1.json","sourceId":"uc:UC-RISK-09","targetDetailPath":"/data/v1/records/risk-risk-assessment-inadequate-328128b5.json","targetId":"risk:risk-assessment-inadequate","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b67300eb2d689d0903ad06cac568091950992187742b8eb36e359a54e5a41ae0","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-erm-e12-ec851dae.json","sourceId":"ctrl:coso-erm:E12","targetDetailPath":"/data/v1/records/std-coso-erm-7265cc54.json","targetId":"std:coso-erm","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:bc2f706c39a245ca096d84ec65bbc75c8c6cef2be5d91906618938539be65383","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-erm-e2-e2ec476e.json","sourceId":"ctrl:coso-erm:E2","targetDetailPath":"/data/v1/records/std-coso-erm-7265cc54.json","targetId":"std:coso-erm","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:c0bae0dccc8f1428dc38fe0134176e0295206acb8b916d735b708929fd762606","properties":{"rationale":"","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-15-e01fb134.json","sourceId":"uc:UC-RISK-15","targetDetailPath":"/data/v1/records/risk-ops-product-service-quality-2066b257.json","targetId":"risk:ops-product-service-quality","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:cd61c3b1baa3e28a7d7931c4de26b4e76b41b604b1c14be3aef00a6ea4e00b46","properties":{"control_id":"E13","coverage":"full","delta":null,"framework":"coso-erm","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2017"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-09-06ffdff1.json","sourceId":"uc:UC-RISK-09","targetDetailPath":"/data/v1/records/ctrl-coso-erm-e13-89e2311d.json","targetId":"ctrl:coso-erm:E13","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:cefd16afb3bee8931d0986f095a7fc954359fc5ac0bb3e0ba28519365d40a052","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-erm-e1-2389ffca.json","sourceId":"ctrl:coso-erm:E1","targetDetailPath":"/data/v1/records/std-coso-erm-7265cc54.json","targetId":"std:coso-erm","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:cf2cfba7148996d1d10c1f51d8f5aba1d8448c96b182a70314fb11ecd83849b3","properties":{"control_id":"E17","coverage":"full","delta":null,"framework":"coso-erm","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2017"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-15-e01fb134.json","sourceId":"uc:UC-RISK-15","targetDetailPath":"/data/v1/records/ctrl-coso-erm-e17-b3a68941.json","targetId":"ctrl:coso-erm:E17","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d51e0c2cff0f07ea472ce919c8211ae63ac98498cba09607ba2ea89d79975ebe","properties":{"rationale":"Board/audit-committee oversight of internal control provides challenge that helps surface ICFR material weaknesses.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-05-b3a47944.json","sourceId":"uc:UC-GOV-05","targetDetailPath":"/data/v1/records/risk-fin-icfr-material-weakness-cdd66323.json","targetId":"risk:fin-icfr-material-weakness","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d6ed284de56ace12f7b7eefc3703a0c75858bf2f8b0f57dd78dc4d8bd39e7ed9","properties":{"rationale":"","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-13-75b9f6c7.json","sourceId":"uc:UC-RISK-13","targetDetailPath":"/data/v1/records/risk-ai-environmental-footprint-c86cf6c9.json","targetId":"risk:ai-environmental-footprint","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d99ee6fd250ac00aca389c804b95e53b0b2bb978cb9746df6d07d4e66eb22139","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-erm-e8-a07b32ad.json","sourceId":"ctrl:coso-erm:E8","targetDetailPath":"/data/v1/records/std-coso-erm-7265cc54.json","targetId":"std:coso-erm","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:de8d6709ab9dabdb8f48b03bd4d7b13076c63669a00fce9accb486fdca9e9713","properties":{"control_id":"E3","coverage":"full","delta":null,"framework":"coso-erm","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2017"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-04-849a3e91.json","sourceId":"uc:UC-GOV-04","targetDetailPath":"/data/v1/records/ctrl-coso-erm-e3-2d76e2c2.json","targetId":"ctrl:coso-erm:E3","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:def23d1c288a2739ddb09d7a99d80475f3e63aff401fc28cbc44da318c7d47e9","properties":{"control_id":"E14","coverage":"full","delta":null,"framework":"coso-erm","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2017"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-10-6d44f690.json","sourceId":"uc:UC-RISK-10","targetDetailPath":"/data/v1/records/ctrl-coso-erm-e14-68b8e783.json","targetId":"ctrl:coso-erm:E14","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e4601263782eadb2db3fb69dfa06c7a5e3eab3998d8ecee271a401df17fde934","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-erm-e6-bd22ee90.json","sourceId":"ctrl:coso-erm:E6","targetDetailPath":"/data/v1/records/std-coso-erm-7265cc54.json","targetId":"std:coso-erm","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e6bbca6e82ad95db9e5bfed418813c2d0fa620855cf05aa060034183e252e4ba","properties":{"control_id":"E12","coverage":"full","delta":null,"framework":"coso-erm","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2017"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-08-5f27bebc.json","sourceId":"uc:UC-RISK-08","targetDetailPath":"/data/v1/records/ctrl-coso-erm-e12-ec851dae.json","targetId":"ctrl:coso-erm:E12","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e78e6d8318dddee9a06047c187236305d89bfc8b8d1dd425132f1ec1ac0247cf","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-erm-e15-7207b4fa.json","sourceId":"ctrl:coso-erm:E15","targetDetailPath":"/data/v1/records/std-coso-erm-7265cc54.json","targetId":"std:coso-erm","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:eb8a92ee9147d22d15483dad03daec755ff8fe66bac30b759383add3cafb9eb1","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-erm-e20-5b937dac.json","sourceId":"ctrl:coso-erm:E20","targetDetailPath":"/data/v1/records/std-coso-erm-7265cc54.json","targetId":"std:coso-erm","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:eb93282202b2513404526abe258f89148b8ba4a6f81b9f111b2615b15ead0ff3","properties":{"rationale":"","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-13-75b9f6c7.json","sourceId":"uc:UC-RISK-13","targetDetailPath":"/data/v1/records/risk-ops-product-service-quality-2066b257.json","targetId":"risk:ops-product-service-quality","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:eebb25824b119480fac503dfc8b7fdf958ae3a5a04b670ecc90af14051e65c42","properties":{"rationale":"Workforce planning, retention, and succession planning directly reduce the talent-departure loss of capacity the risk names.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-10-016614d1.json","sourceId":"uc:UC-GOV-10","targetDetailPath":"/data/v1/records/risk-gov-organizational-change-resistance-a8383ccb.json","targetId":"risk:gov-organizational-change-resistance","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:eebc23cf930fc9d7924ffdcc9d469b6529907a8bd31cb525dda6b67b31ebb4a5","properties":{"rationale":"","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-21-8c5d79f9.json","sourceId":"uc:UC-GOV-21","targetDetailPath":"/data/v1/records/risk-fin-crime-aml-sanctions-80b15201.json","targetId":"risk:fin-crime-aml-sanctions","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:fbaa12d602f25210b85d321f0b0a55ca0d910209702e3d84ba7a90e54537e00e","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-erm-e9-9633a103.json","sourceId":"ctrl:coso-erm:E9","targetDetailPath":"/data/v1/records/std-coso-erm-7265cc54.json","targetId":"std:coso-erm","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:fc1864e38234f319edeb1291aab138591e799e19c843dbcba7d1b80c5e00e01a","properties":{"control_id":"E4","coverage":"full","delta":null,"framework":"coso-erm","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2017"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-04-849a3e91.json","sourceId":"uc:UC-GOV-04","targetDetailPath":"/data/v1/records/ctrl-coso-erm-e4-97e5f081.json","targetId":"ctrl:coso-erm:E4","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:fda71e41615a40a1fba57d5edf79eb5cec9502bc8b254d7a4b3a461c70f91a37","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-erm-e3-2d76e2c2.json","sourceId":"ctrl:coso-erm:E3","targetDetailPath":"/data/v1/records/std-coso-erm-7265cc54.json","targetId":"std:coso-erm","type":"belongs_to"}],"schemaVersion":1,"scope":"sources","total":101}