{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","contextIds":["risk:asset-inventory-gap","risk:compliance-regulatory-policy-change","risk:config-poor-baseline-drift","risk:config-weak-change-control","risk:cyber-adversary-threat-sources","risk:data-inventory-flows-unmapped","risk:esg-social-human-rights","risk:fin-crime-aml-sanctions","risk:fin-financial-statement-fraud","risk:fin-icfr-material-weakness","risk:financial-liquidity-capital","risk:fraud-internal-misappropriation","risk:fraud-unauthorized-trading-activity","risk:gov-organizational-change-resistance","risk:gov-oversight-failure","risk:gov-policy-absent","risk:gov-weak-internal-control","risk:hr-missing-security-terms-discipline","risk:ir-no-response-procedures","risk:ops-core-process-inefficiency","risk:reputational-brand-crisis","risk:reputational-stakeholder-trust","risk:risk-assessment-inadequate"],"directIds":["ctrl:coso-ic:P1","ctrl:coso-ic:P10","ctrl:coso-ic:P11","ctrl:coso-ic:P12","ctrl:coso-ic:P13","ctrl:coso-ic:P14","ctrl:coso-ic:P15","ctrl:coso-ic:P16","ctrl:coso-ic:P17","ctrl:coso-ic:P2","ctrl:coso-ic:P3","ctrl:coso-ic:P4","ctrl:coso-ic:P5","ctrl:coso-ic:P6","ctrl:coso-ic:P7","ctrl:coso-ic:P8","ctrl:coso-ic:P9"],"kind":"bundle","metadata":"/assets/agent_metadata.5c7612c9c5b0b455.json","name":"COSO IC 2013","next":"/assets/agent_sources-coso-ic-2.d3d08d5b51f3f151.json","page":1,"pageSize":40,"records":[{"attributes":{"category":"administrative","framework":"coso-ic","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/coso-ic/","description":"The organization demonstrates a commitment to integrity and ethical values.","details":{"automation":"manual","control_category":"administrative","control_id":"P1","control_type":"preventive","domains":["Financial Reporting Controls (SOX)","Governance, Policy & Oversight"],"framework":"coso-ic","group":"Control Environment","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":5,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-coso-ic-p1-f41d97ed.html","id":"ctrl:coso-ic:P1","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acoso-ic%3AP1","sourceIds":["coso-ic"],"sourceUrl":null,"title":"P1 — The organization demonstrates a commitment to integrity and ethical values.","type":"control","url":"/assets/agent_record-ctrl-coso-ic-p1-f41d97ed.bf7947e24cb1aa8f.json"},{"attributes":{"category":"administrative","framework":"coso-ic","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/coso-ic/","description":"The organization selects and develops control activities that contribute to the mitigation of risks to the achievement of objectives to acceptable levels.","details":{"automation":"manual","control_category":"administrative","control_id":"P10","control_type":"preventive","domains":["Access Control & Identity Management","Financial Reporting Controls (SOX)"],"framework":"coso-ic","group":"Control Activities","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-coso-ic-p10-c5a97f20.html","id":"ctrl:coso-ic:P10","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acoso-ic%3AP10","sourceIds":["coso-ic"],"sourceUrl":null,"title":"P10 — The organization selects and develops control activities that contribute to the mitigation of risks to the achievement of objectives to acceptable levels.","type":"control","url":"/assets/agent_record-ctrl-coso-ic-p10-c5a97f20.8685a7df744a787f.json"},{"attributes":{"category":"administrative","framework":"coso-ic","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/coso-ic/","description":"The organization selects and develops general control activities over technology to support the achievement of objectives.","details":{"automation":"manual","control_category":"administrative","control_id":"P11","control_type":"preventive","domains":["Access Control & Identity Management","Business Continuity & Disaster Recovery","Cryptography & Key Management","Data Protection & Privacy","Financial Reporting Controls (SOX)","Network & Communications Security","Physical & Environmental Security","Secure Configuration & Change Management","Secure Development (SDLC) & Application Security"],"framework":"coso-ic","group":"Control Activities","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-coso-ic-p11-2a08883b.html","id":"ctrl:coso-ic:P11","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acoso-ic%3AP11","sourceIds":["coso-ic"],"sourceUrl":null,"title":"P11 — The organization selects and develops general control activities over technology to support the achievement of objectives.","type":"control","url":"/assets/agent_record-ctrl-coso-ic-p11-2a08883b.f7b1fd369c20e6b6.json"},{"attributes":{"category":"administrative","framework":"coso-ic","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/coso-ic/","description":"The organization deploys control activities through policies that establish what is expected and procedures that put policies into action.","details":{"automation":"manual","control_category":"administrative","control_id":"P12","control_type":"preventive","domains":["AI Governance","Financial Reporting Controls (SOX)","Secure Configuration & Change Management","Secure Development (SDLC) & Application Security"],"framework":"coso-ic","group":"Control Activities","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-coso-ic-p12-233c8710.html","id":"ctrl:coso-ic:P12","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acoso-ic%3AP12","sourceIds":["coso-ic"],"sourceUrl":null,"title":"P12 — The organization deploys control activities through policies that establish what is expected and procedures that put policies into action.","type":"control","url":"/assets/agent_record-ctrl-coso-ic-p12-233c8710.67371e11c8053dff.json"},{"attributes":{"category":"administrative","framework":"coso-ic","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/coso-ic/","description":"The organization obtains or generates and uses relevant, quality information to support the functioning of internal control.","details":{"automation":"manual","control_category":"administrative","control_id":"P13","control_type":"preventive","domains":["Asset Management & Inventory","Data Protection & Privacy","Financial Reporting Controls (SOX)"],"framework":"coso-ic","group":"Information & Communication","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-coso-ic-p13-0c70843b.html","id":"ctrl:coso-ic:P13","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acoso-ic%3AP13","sourceIds":["coso-ic"],"sourceUrl":null,"title":"P13 — The organization obtains or generates and uses relevant, quality information to support the functioning of internal control.","type":"control","url":"/assets/agent_record-ctrl-coso-ic-p13-0c70843b.fc063ba70f8a75b7.json"},{"attributes":{"category":"administrative","framework":"coso-ic","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/coso-ic/","description":"The organization internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control.","details":{"automation":"manual","control_category":"administrative","control_id":"P14","control_type":"preventive","domains":["Awareness & Training","Financial Reporting Controls (SOX)","Logging, Monitoring & Detection"],"framework":"coso-ic","group":"Information & Communication","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-coso-ic-p14-4f2da7a2.html","id":"ctrl:coso-ic:P14","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acoso-ic%3AP14","sourceIds":["coso-ic"],"sourceUrl":null,"title":"P14 — The organization internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control.","type":"control","url":"/assets/agent_record-ctrl-coso-ic-p14-4f2da7a2.9106858ee5f901b6.json"},{"attributes":{"category":"administrative","framework":"coso-ic","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/coso-ic/","description":"The organization communicates with external parties regarding matters affecting the functioning of internal control.","details":{"automation":"manual","control_category":"administrative","control_id":"P15","control_type":"preventive","domains":["Compliance, Audit & Assurance","Financial Reporting Controls (SOX)"],"framework":"coso-ic","group":"Information & Communication","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-coso-ic-p15-04537dd0.html","id":"ctrl:coso-ic:P15","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acoso-ic%3AP15","sourceIds":["coso-ic"],"sourceUrl":null,"title":"P15 — The organization communicates with external parties regarding matters affecting the functioning of internal control.","type":"control","url":"/assets/agent_record-ctrl-coso-ic-p15-04537dd0.cd4963c320fdfc50.json"},{"attributes":{"category":"administrative","framework":"coso-ic","type":"detective"},"canonicalUrl":"https://controlsmap.com/frameworks/coso-ic/","description":"The organization selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning.","details":{"automation":"manual","control_category":"administrative","control_id":"P16","control_type":"detective","domains":["Business Continuity & Disaster Recovery","Compliance, Audit & Assurance","Financial Reporting Controls (SOX)","Incident Management & Response","Logging, Monitoring & Detection","Vulnerability & Patch Management"],"framework":"coso-ic","group":"Monitoring Activities","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-coso-ic-p16-4995bb68.html","id":"ctrl:coso-ic:P16","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acoso-ic%3AP16","sourceIds":["coso-ic"],"sourceUrl":null,"title":"P16 — The organization selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning.","type":"control","url":"/assets/agent_record-ctrl-coso-ic-p16-4995bb68.bc0f3cf9b5d642eb.json"},{"attributes":{"category":"administrative","framework":"coso-ic","type":"corrective"},"canonicalUrl":"https://controlsmap.com/frameworks/coso-ic/","description":"The organization evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate.","details":{"automation":"manual","control_category":"administrative","control_id":"P17","control_type":"corrective","domains":["Compliance, Audit & Assurance","Financial Reporting Controls (SOX)","Incident Management & Response"],"framework":"coso-ic","group":"Monitoring Activities","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":1,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-coso-ic-p17-277098f3.html","id":"ctrl:coso-ic:P17","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acoso-ic%3AP17","sourceIds":["coso-ic"],"sourceUrl":null,"title":"P17 — The organization evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate.","type":"control","url":"/assets/agent_record-ctrl-coso-ic-p17-277098f3.286298345bb2e228.json"},{"attributes":{"category":"administrative","framework":"coso-ic","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/coso-ic/","description":"The board of directors demonstrates independence from management and exercises oversight of the development and performance of internal control.","details":{"automation":"manual","control_category":"administrative","control_id":"P2","control_type":"preventive","domains":["Financial Reporting Controls (SOX)","Governance, Policy & Oversight"],"framework":"coso-ic","group":"Control Environment","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-coso-ic-p2-4f80775c.html","id":"ctrl:coso-ic:P2","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acoso-ic%3AP2","sourceIds":["coso-ic"],"sourceUrl":null,"title":"P2 — The board of directors demonstrates independence from management and exercises oversight of the development and performance of internal control.","type":"control","url":"/assets/agent_record-ctrl-coso-ic-p2-4f80775c.4961dddfac783f79.json"},{"attributes":{"category":"administrative","framework":"coso-ic","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/coso-ic/","description":"Management establishes, with board oversight, structures, reporting lines, and appropriate authorities and responsibilities in the pursuit of objectives.","details":{"automation":"manual","control_category":"administrative","control_id":"P3","control_type":"preventive","domains":["Financial Reporting Controls (SOX)","Governance, Policy & Oversight"],"framework":"coso-ic","group":"Control Environment","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-coso-ic-p3-8a6c14d5.html","id":"ctrl:coso-ic:P3","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acoso-ic%3AP3","sourceIds":["coso-ic"],"sourceUrl":null,"title":"P3 — Management establishes, with board oversight, structures, reporting lines, and appropriate authorities and responsibilities in the pursuit of objectives.","type":"control","url":"/assets/agent_record-ctrl-coso-ic-p3-8a6c14d5.c8fb896c4bb23798.json"},{"attributes":{"category":"administrative","framework":"coso-ic","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/coso-ic/","description":"The organization demonstrates a commitment to attract, develop, and retain competent individuals in alignment with objectives.","details":{"automation":"manual","control_category":"administrative","control_id":"P4","control_type":"preventive","domains":["Awareness & Training","Governance, Policy & Oversight","Human Resources / Personnel Security"],"framework":"coso-ic","group":"Control Environment","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-coso-ic-p4-8da1f64c.html","id":"ctrl:coso-ic:P4","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acoso-ic%3AP4","sourceIds":["coso-ic"],"sourceUrl":null,"title":"P4 — The organization demonstrates a commitment to attract, develop, and retain competent individuals in alignment with objectives.","type":"control","url":"/assets/agent_record-ctrl-coso-ic-p4-8da1f64c.dd7a3ea8c36e469d.json"},{"attributes":{"category":"administrative","framework":"coso-ic","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/coso-ic/","description":"The organization holds individuals accountable for their internal control responsibilities in the pursuit of objectives.","details":{"automation":"manual","control_category":"administrative","control_id":"P5","control_type":"preventive","domains":["Governance, Policy & Oversight","Human Resources / Personnel Security"],"framework":"coso-ic","group":"Control Environment","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-coso-ic-p5-7f62f522.html","id":"ctrl:coso-ic:P5","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acoso-ic%3AP5","sourceIds":["coso-ic"],"sourceUrl":null,"title":"P5 — The organization holds individuals accountable for their internal control responsibilities in the pursuit of objectives.","type":"control","url":"/assets/agent_record-ctrl-coso-ic-p5-7f62f522.36791ace8dd5f10f.json"},{"attributes":{"category":"administrative","framework":"coso-ic","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/coso-ic/","description":"The organization specifies objectives with sufficient clarity to enable the identification and assessment of risks relating to objectives.","details":{"automation":"manual","control_category":"administrative","control_id":"P6","control_type":"preventive","domains":["AI Governance","Risk Assessment & Management"],"framework":"coso-ic","group":"Risk Assessment","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-coso-ic-p6-e614a304.html","id":"ctrl:coso-ic:P6","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acoso-ic%3AP6","sourceIds":["coso-ic"],"sourceUrl":null,"title":"P6 — The organization specifies objectives with sufficient clarity to enable the identification and assessment of risks relating to objectives.","type":"control","url":"/assets/agent_record-ctrl-coso-ic-p6-e614a304.8f22dfb25d654e56.json"},{"attributes":{"category":"administrative","framework":"coso-ic","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/coso-ic/","description":"The organization identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed.","details":{"automation":"manual","control_category":"administrative","control_id":"P7","control_type":"preventive","domains":["AI Governance","Risk Assessment & Management","Third-Party / Supply-Chain Risk"],"framework":"coso-ic","group":"Risk Assessment","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-coso-ic-p7-a272f700.html","id":"ctrl:coso-ic:P7","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acoso-ic%3AP7","sourceIds":["coso-ic"],"sourceUrl":null,"title":"P7 — The organization identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed.","type":"control","url":"/assets/agent_record-ctrl-coso-ic-p7-a272f700.857cd7fd11a55c0c.json"},{"attributes":{"category":"administrative","framework":"coso-ic","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/coso-ic/","description":"The organization considers the potential for fraud in assessing risks to the achievement of objectives.","details":{"automation":"manual","control_category":"administrative","control_id":"P8","control_type":"preventive","domains":["Risk Assessment & Management"],"framework":"coso-ic","group":"Risk Assessment","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-coso-ic-p8-e85b1bf7.html","id":"ctrl:coso-ic:P8","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acoso-ic%3AP8","sourceIds":["coso-ic"],"sourceUrl":null,"title":"P8 — The organization considers the potential for fraud in assessing risks to the achievement of objectives.","type":"control","url":"/assets/agent_record-ctrl-coso-ic-p8-e85b1bf7.e1d64e50d05e463c.json"},{"attributes":{"category":"administrative","framework":"coso-ic","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/coso-ic/","description":"The organization identifies and assesses changes that could significantly impact the system of internal control.","details":{"automation":"manual","control_category":"administrative","control_id":"P9","control_type":"preventive","domains":["Risk Assessment & Management","Third-Party / Supply-Chain Risk"],"framework":"coso-ic","group":"Risk Assessment","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":4,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-coso-ic-p9-8a96cb71.html","id":"ctrl:coso-ic:P9","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Acoso-ic%3AP9","sourceIds":["coso-ic"],"sourceUrl":null,"title":"P9 — The organization identifies and assesses changes that could significantly impact the system of internal control.","type":"control","url":"/assets/agent_record-ctrl-coso-ic-p9-8a96cb71.983a56d89d3d016f.json"},{"attributes":{"category":"operational","domain":["Asset Management & Inventory","Data Protection & Privacy"],"inherent_rating":"medium","taxonomy":["iso-27005-vulnerability"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Aasset-inventory-gap","description":"No authoritative inventory of information and associated assets, missing ownership, acceptable-use, classification, labelling, or handling rules — preventing effective protection, risk assessment, and secure disposal.","details":{"category":"operational","impact":"medium","inherent_rating":"medium","likelihood":"high","risk_id":"asset-inventory-gap","taxonomies":["iso-27005-vulnerability"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-asset-inventory-gap-e18c7e73.html","id":"risk:asset-inventory-gap","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Aasset-inventory-gap","sourceIds":["coso-ic","gdpr","iso-27001","nist-800-53","nist-csf-2","soc2"],"sourceUrl":null,"title":"Incomplete asset inventory and classification","type":"risk","url":"/assets/agent_record-risk-asset-inventory-gap-e18c7e73.eff694953485c2c6.json"},{"attributes":{"category":"compliance_regulatory","domain":["Compliance, Audit & Assurance","Risk Assessment & Management"],"inherent_rating":"medium","taxonomy":["coso-erm-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Acompliance-regulatory-policy-change","description":"Changes in law, regulation, tax policy, or government programs materially alter the entity’s cost structure, competitive dynamics, or permissible business practices, requiring costly adaptation.","details":{"category":"compliance_regulatory","impact":"medium","inherent_rating":"medium","likelihood":"medium","risk_id":"compliance-regulatory-policy-change","taxonomies":["coso-erm-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-compliance-regulatory-policy-change-9429f25b.html","id":"risk:compliance-regulatory-policy-change","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Acompliance-regulatory-policy-change","sourceIds":["cobit-2019","coso-erm","coso-ic","iso-27001","iso-31000","soc2"],"sourceUrl":null,"title":"Adverse regulatory or policy change","type":"risk","url":"/assets/agent_record-risk-compliance-regulatory-policy-change-9429f25b.c922efc13b75a562.json"},{"attributes":{"category":"cyber_security","domain":["Secure Configuration & Change Management","Vulnerability & Patch Management"],"inherent_rating":"high","taxonomy":["iso-27005-vulnerability","nist-800-30-threat-event"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Aconfig-poor-baseline-drift","description":"Without documented, enforced baseline configurations and change control, systems drift into insecure states, contain unauthorized changes, or expose unnecessary network services, expanding attack surface.","details":{"category":"cyber_security","impact":"medium","inherent_rating":"high","likelihood":"high","risk_id":"config-poor-baseline-drift","taxonomies":["iso-27005-vulnerability","nist-800-30-threat-event"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-config-poor-baseline-drift-2dd66324.html","id":"risk:config-poor-baseline-drift","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Aconfig-poor-baseline-drift","sourceIds":["coso-ic","iso-27001","nist-800-53","nist-csf-2","nydfs-500","pci-dss","soc1","soc2","sox"],"sourceUrl":null,"title":"Poor configuration management and insecure baseline drift","type":"risk","url":"/assets/agent_record-risk-config-poor-baseline-drift-2dd66324.de11f6b9169c61ac.json"},{"attributes":{"category":"cyber_security","domain":["Secure Configuration & Change Management","Secure Development (SDLC) & Application Security"],"inherent_rating":"medium","taxonomy":["iso-27005-vulnerability"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Aconfig-weak-change-control","description":"Changes to systems, software, hardware, or configurations without formal approval and testing (including unauthorized or poorly tested hardware/config changes) introduce new vulnerabilities, instability, or failed releases.","details":{"category":"cyber_security","impact":"medium","inherent_rating":"medium","likelihood":"medium","risk_id":"config-weak-change-control","taxonomies":["iso-27005-vulnerability"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-config-weak-change-control-e7d90eaf.html","id":"risk:config-weak-change-control","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Aconfig-weak-change-control","sourceIds":["cobit-2019","coso-ic","iso-27001","nist-800-53","nist-csf-2","soc1","soc2","sox"],"sourceUrl":null,"title":"Absent or weak change-control procedures","type":"risk","url":"/assets/agent_record-risk-config-weak-change-control-e7d90eaf.0118c76865b2782b.json"},{"attributes":{"category":"cyber_security","domain":["Risk Assessment & Management","Logging, Monitoring & Detection"],"inherent_rating":"high","taxonomy":["nist-800-30-threat-source"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Acyber-adversary-threat-sources","description":"Because capable, motivated threat actors - outsiders, privileged and non-privileged insiders, organized groups, competitors, malicious partners or suppliers, and nation-states - actively target the organization's cyber resources, deliberate attacks are attempted against its systems and data, resulting in compromise, disruption, or theft when defenses are outmatched.","details":{"category":"cyber_security","impact":"high","inherent_rating":"high","likelihood":"high","risk_id":"cyber-adversary-threat-sources","taxonomies":["nist-800-30-threat-source"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-cyber-adversary-threat-sources-fa9e3003.html","id":"risk:cyber-adversary-threat-sources","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Acyber-adversary-threat-sources","sourceIds":["aiuc-1","cobit-2019","coso-ic","gdpr","iso-27001","iso-31000","nist-800-53","nist-csf-2","nydfs-500","soc1","soc2","sox"],"sourceUrl":null,"title":"Attacks by capable, motivated threat actors","type":"risk","url":"/assets/agent_record-risk-cyber-adversary-threat-sources-fa9e3003.8ace32770a775a42.json"},{"attributes":{"category":"privacy","domain":["Data Protection & Privacy","Asset Management & Inventory"],"inherent_rating":"medium","taxonomy":["nist-privacy-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Adata-inventory-flows-unmapped","description":"No authoritative record of what personal data is held, where, who accesses it, and how it flows to processors/sub-processors and across borders — preventing risk assessment, DSR fulfilment, and enforcement of privacy obligations.","details":{"category":"privacy","impact":"medium","inherent_rating":"medium","likelihood":"high","risk_id":"data-inventory-flows-unmapped","taxonomies":["nist-privacy-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-data-inventory-flows-unmapped-fd7746f8.html","id":"risk:data-inventory-flows-unmapped","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Adata-inventory-flows-unmapped","sourceIds":["coso-ic","gdpr","nist-800-53","nist-csf-2","soc2"],"sourceUrl":null,"title":"Undocumented data inventory and unmapped data flows","type":"risk","url":"/assets/agent_record-risk-data-inventory-flows-unmapped-fd7746f8.a02a8c6342331cd0.json"},{"attributes":{"category":"esg","domain":["Third-Party / Supply-Chain Risk","Human Resources / Personnel Security","Compliance, Audit & Assurance"],"inherent_rating":"medium","taxonomy":["coso-erm-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Aesg-social-human-rights","description":"Failure to respect human rights — forced or child labour, discrimination, unsafe conditions — in operations and supply chains, resulting in legal liability, boycotts, and ESG rating downgrades.","details":{"category":"esg","impact":"high","inherent_rating":"medium","likelihood":"low","risk_id":"esg-social-human-rights","taxonomies":["coso-erm-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-esg-social-human-rights-1dbeca21.html","id":"risk:esg-social-human-rights","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Aesg-social-human-rights","sourceIds":["coso-ic","iia-2024"],"sourceUrl":null,"title":"Social and human-rights failures in operations and supply chain","type":"risk","url":"/assets/agent_record-risk-esg-social-human-rights-1dbeca21.962e236206a0b286.json"},{"attributes":{"category":"compliance_regulatory","domain":["Compliance, Audit & Assurance","Risk Assessment & Management","Governance, Policy & Oversight"],"inherent_rating":"high","taxonomy":["enterprise-risk","basel-operational-risk","coso-erm-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Afin-crime-aml-sanctions","description":"Failure to prevent money laundering or terrorist financing, file SARs/CTRs, perform adequate KYC/beneficial-ownership due diligence, screen for PEPs, or avoid processing transactions for OFAC-sanctioned parties; BSA/AML program deficiencies.","details":{"category":"compliance_regulatory","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"fin-crime-aml-sanctions","taxonomies":["enterprise-risk","basel-operational-risk","coso-erm-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-fin-crime-aml-sanctions-80b15201.html","id":"risk:fin-crime-aml-sanctions","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Afin-crime-aml-sanctions","sourceIds":["cobit-2019","coso-erm","coso-ic","iso-31000","nist-csf-2","soc2"],"sourceUrl":null,"title":"Money laundering, sanctions and financial-crime program failures","type":"risk","url":"/assets/agent_record-risk-fin-crime-aml-sanctions-80b15201.3441cdfac714d353.json"},{"attributes":{"category":"financial_reporting","domain":["Financial Reporting Controls (SOX)","Compliance, Audit & Assurance"],"inherent_rating":"high","taxonomy":["sox-rmm-assertion","coso-erm-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Afin-financial-statement-fraud","description":"Intentional misstatement through fictitious revenue, phantom inventory/assets, ghost-employee payroll, or management override of controls — inflating results and deceiving investors and regulators.","details":{"category":"financial_reporting","impact":"critical","inherent_rating":"high","likelihood":"low","risk_id":"fin-financial-statement-fraud","taxonomies":["sox-rmm-assertion","coso-erm-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-fin-financial-statement-fraud-1dd35d5a.html","id":"risk:fin-financial-statement-fraud","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Afin-financial-statement-fraud","sourceIds":["cobit-2019","coso-ic","iia-2024","iso-27001","nist-800-53","soc2","sox"],"sourceUrl":null,"title":"Financial-statement fraud and management override","type":"risk","url":"/assets/agent_record-risk-fin-financial-statement-fraud-1dd35d5a.0b3cf75ecebe244f.json"},{"attributes":{"category":"financial_reporting","domain":["Financial Reporting Controls (SOX)","Compliance, Audit & Assurance","Governance, Policy & Oversight"],"inherent_rating":"critical","taxonomy":["enterprise-risk","coso-erm-risk","sox-rmm-assertion"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Afin-icfr-material-weakness","description":"Because internal control over financial reporting is not maintained effectively - material weaknesses undetected or undisclosed and certifications signed despite known deficiencies - financial statements may be materially misstated and filings delayed or restated, resulting in SEC enforcement, delisting, securities-fraud liability, and loss of investor confidence.","details":{"category":"financial_reporting","impact":"critical","inherent_rating":"critical","likelihood":"medium","risk_id":"fin-icfr-material-weakness","taxonomies":["enterprise-risk","coso-erm-risk","sox-rmm-assertion"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-fin-icfr-material-weakness-cdd66323.html","id":"risk:fin-icfr-material-weakness","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Afin-icfr-material-weakness","sourceIds":["cobit-2019","coso-erm","coso-ic","iia-2024","iso-27001","nis2","nist-800-53","nist-csf-2","soc2","sox"],"sourceUrl":null,"title":"Ineffective ICFR / undisclosed material weakness","type":"risk","url":"/assets/agent_record-risk-fin-icfr-material-weakness-cdd66323.c752785baa39846a.json"},{"attributes":{"category":"financial","domain":["Risk Assessment & Management"],"inherent_rating":"high","taxonomy":["enterprise-risk","coso-erm-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Afinancial-liquidity-capital","description":"Cash-flow shortfall from working-capital deterioration, covenant breaches accelerating debt, loss of revolving credit, or capital-market disruption; debt maturity walls and downgrades limiting refinancing at acceptable terms; insufficient capital to absorb losses.","details":{"category":"financial","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"financial-liquidity-capital","taxonomies":["enterprise-risk","coso-erm-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-financial-liquidity-capital-e0ac2d24.html","id":"risk:financial-liquidity-capital","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Afinancial-liquidity-capital","sourceIds":["coso-erm","coso-ic","iso-31000","nist-800-53","nist-csf-2","nydfs-500","soc2","sox"],"sourceUrl":null,"title":"Liquidity, capital-structure and refinancing risk","type":"risk","url":"/assets/agent_record-risk-financial-liquidity-capital-e0ac2d24.0f938fc816181917.json"},{"attributes":{"category":"operational","domain":["Governance, Policy & Oversight","Financial Reporting Controls (SOX)","Risk Assessment & Management"],"inherent_rating":"high","taxonomy":["basel-operational-risk","coso-erm-risk","sox-rmm-assertion"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Afraud-internal-misappropriation","description":"Employees defraud the entity for financial gain: embezzlement or theft of company/client funds, fraudulent expense/payroll claims, forgery to obtain unauthorized disbursements, bribery/kickback schemes, insider trading on own account, and wilful tax evasion.","details":{"category":"operational","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"fraud-internal-misappropriation","taxonomies":["basel-operational-risk","coso-erm-risk","sox-rmm-assertion"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-fraud-internal-misappropriation-d235cd10.html","id":"risk:fraud-internal-misappropriation","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Afraud-internal-misappropriation","sourceIds":["coso-erm","coso-ic","iso-27001","nis2","nist-800-53","nist-csf-2","soc2","sox"],"sourceUrl":null,"title":"Internal fraud — asset misappropriation, embezzlement, forgery","type":"risk","url":"/assets/agent_record-risk-fraud-internal-misappropriation-d235cd10.340e455cacc8708f.json"},{"attributes":{"category":"operational","domain":["Risk Assessment & Management","Financial Reporting Controls (SOX)","Governance, Policy & Oversight"],"inherent_rating":"high","taxonomy":["basel-operational-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Afraud-unauthorized-trading-activity","description":"Losses from transactions not reported or of an unauthorized type, deliberate mismarking of positions, fictitious trade bookings to conceal losses, and circumvention of position/risk limits without disclosure (e.g. rogue trader).","details":{"category":"operational","impact":"high","inherent_rating":"high","likelihood":"low","risk_id":"fraud-unauthorized-trading-activity","taxonomies":["basel-operational-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-fraud-unauthorized-trading-activity-e5d9d4b9.html","id":"risk:fraud-unauthorized-trading-activity","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Afraud-unauthorized-trading-activity","sourceIds":["coso-ic","iso-27001","nist-800-53","soc2","sox"],"sourceUrl":null,"title":"Unauthorized activity — rogue trading, position mismarking, concealment","type":"risk","url":"/assets/agent_record-risk-fraud-unauthorized-trading-activity-e5d9d4b9.f797ec96546cf223.json"},{"attributes":{"category":"operational","domain":["Human Resources / Personnel Security","Governance, Policy & Oversight"],"inherent_rating":"medium","taxonomy":["coso-erm-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Agov-organizational-change-resistance","description":"Significant structural or cultural change (restructuring, ERP/digital transformation) causes employee resistance, productivity loss, or talent departures that undermine the entity’s capacity to adapt to strategic imperatives.","details":{"category":"operational","impact":"medium","inherent_rating":"medium","likelihood":"medium","risk_id":"gov-organizational-change-resistance","taxonomies":["coso-erm-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-gov-organizational-change-resistance-a8383ccb.html","id":"risk:gov-organizational-change-resistance","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Agov-organizational-change-resistance","sourceIds":["cobit-2019","coso-erm","coso-ic","nist-800-53","nydfs-500"],"sourceUrl":null,"title":"Organizational change and transformation failure","type":"risk","url":"/assets/agent_record-risk-gov-organizational-change-resistance-a8383ccb.a2e8f3631e7bd023.json"},{"attributes":{"category":"strategic","domain":["Governance, Policy & Oversight","Compliance, Audit & Assurance"],"inherent_rating":"high","taxonomy":["coso-erm-risk","iso-27005-vulnerability"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Agov-oversight-failure","description":"Because board and management oversight of risk and control is weak - unclear tone at the top, ineffective board composition or independence, poor committee structure, and limited senior-management commitment - control priorities are not enforced and resources are withheld, so risks accumulate unmanaged and control failures go uncorrected across the entity.","details":{"category":"strategic","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"gov-oversight-failure","taxonomies":["coso-erm-risk","iso-27005-vulnerability"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-gov-oversight-failure-d98ffc12.html","id":"risk:gov-oversight-failure","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Agov-oversight-failure","sourceIds":["cobit-2019","coso-erm","coso-ic","iia-2024","iia-pos-2026-erm","nis2","nist-csf-2","soc2","sox"],"sourceUrl":null,"title":"Inadequate board and management oversight of risk and control","type":"risk","url":"/assets/agent_record-risk-gov-oversight-failure-d98ffc12.e05fa5d3e4686a7a.json"},{"attributes":{"category":"compliance_regulatory","domain":["Governance, Policy & Oversight","Data Protection & Privacy"],"inherent_rating":"medium","taxonomy":["iso-27005-vulnerability","nist-privacy-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Agov-policy-absent","description":"Because documented, approved, and enforced security and privacy policies are missing and roles and duties are undefined, personnel operate without guidance on required controls and behaviours, so controls are applied inconsistently and accountability gaps leave violations undetected and unaddressed.","details":{"category":"compliance_regulatory","impact":"medium","inherent_rating":"medium","likelihood":"medium","risk_id":"gov-policy-absent","taxonomies":["iso-27005-vulnerability","nist-privacy-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-gov-policy-absent-cf76dbbf.html","id":"risk:gov-policy-absent","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Agov-policy-absent","sourceIds":["cobit-2019","coso-erm","coso-ic","gdpr","hipaa","iso-27001","nis2","nist-800-53","nist-csf-2","nydfs-500","pci-dss","soc2"],"sourceUrl":null,"title":"Missing or insufficient security and privacy policies","type":"risk","url":"/assets/agent_record-risk-gov-policy-absent-cf76dbbf.643fca249d5d0d9c.json"},{"attributes":{"category":"financial_reporting","domain":["Governance, Policy & Oversight","Financial Reporting Controls (SOX)","Compliance, Audit & Assurance"],"inherent_rating":"high","taxonomy":["coso-erm-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Agov-weak-internal-control","description":"Because the internal control environment is weak - segregation of duties absent, authorization frameworks inadequate, and tone at the top poor - fraudulent and erroneous transactions can be initiated and concealed, resulting in material misstatement and financial, regulatory, and reputational loss.","details":{"category":"financial_reporting","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"gov-weak-internal-control","taxonomies":["coso-erm-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-gov-weak-internal-control-7acb9117.html","id":"risk:gov-weak-internal-control","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Agov-weak-internal-control","sourceIds":["cobit-2019","coso-erm","coso-ic","iia-2024","iso-27001","nist-800-53","nist-csf-2","nydfs-500","soc2","sox"],"sourceUrl":null,"title":"Weak internal control environment enabling fraud and error","type":"risk","url":"/assets/agent_record-risk-gov-weak-internal-control-7acb9117.f087c0c22fea9ee2.json"},{"attributes":{"category":"compliance_regulatory","domain":["Human Resources / Personnel Security","Governance, Policy & Oversight","Third-Party / Supply-Chain Risk"],"inherent_rating":"medium","taxonomy":["iso-27005-vulnerability"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Ahr-missing-security-terms-discipline","description":"Employment and supplier contracts omit security/confidentiality obligations, and there is no disciplinary process for security violations — removing legal recourse and the deterrent effect against repeat offenders.","details":{"category":"compliance_regulatory","impact":"medium","inherent_rating":"medium","likelihood":"medium","risk_id":"hr-missing-security-terms-discipline","taxonomies":["iso-27005-vulnerability"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-hr-missing-security-terms-discipline-0a47163d.html","id":"risk:hr-missing-security-terms-discipline","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Ahr-missing-security-terms-discipline","sourceIds":["ccpa","coso-ic","gdpr","hipaa","iso-27001","nist-800-53","nist-csf-2","soc2"],"sourceUrl":null,"title":"Missing security terms in contracts and no disciplinary process","type":"risk","url":"/assets/agent_record-risk-hr-missing-security-terms-discipline-0a47163d.8fa26facc260e210.json"},{"attributes":{"category":"cyber_security","domain":["Incident Management & Response"],"inherent_rating":"high","taxonomy":["iso-27005-vulnerability","nist-privacy-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Air-no-response-procedures","description":"Without documented, tested incident-response procedures, breaches and failures are handled inconsistently, slowly, or ineffectively, prolonging exposure and amplifying loss.","details":{"category":"cyber_security","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"ir-no-response-procedures","taxonomies":["iso-27005-vulnerability","nist-privacy-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-ir-no-response-procedures-90eb7ba1.html","id":"risk:ir-no-response-procedures","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Air-no-response-procedures","sourceIds":["coso-ic","iso-27001","nist-800-53","nist-csf-2"],"sourceUrl":null,"title":"No or insufficient incident-response procedures","type":"risk","url":"/assets/agent_record-risk-ir-no-response-procedures-90eb7ba1.b2b72f07fbd6765c.json"},{"attributes":{"category":"operational","domain":["Risk Assessment & Management","Governance, Policy & Oversight"],"inherent_rating":"medium","taxonomy":["coso-erm-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Aops-core-process-inefficiency","description":"Poorly designed, undocumented, or poorly executed business processes lead to errors, rework, cost overruns, service failures, and inability to scale operations reliably; large change programs fail to deliver benefits on time and budget.","details":{"category":"operational","impact":"medium","inherent_rating":"medium","likelihood":"medium","risk_id":"ops-core-process-inefficiency","taxonomies":["coso-erm-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-ops-core-process-inefficiency-8e830edd.html","id":"risk:ops-core-process-inefficiency","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Aops-core-process-inefficiency","sourceIds":["cobit-2019","coso-erm","coso-ic","iso-27001","nist-800-53","nist-csf-2","soc2"],"sourceUrl":null,"title":"Core process breakdown and inability to scale","type":"risk","url":"/assets/agent_record-risk-ops-core-process-inefficiency-8e830edd.82a1f86e9f846dd7.json"},{"attributes":{"category":"reputational","domain":["Risk Assessment & Management","Governance, Policy & Oversight"],"inherent_rating":"high","taxonomy":["enterprise-risk","coso-erm-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Areputational-brand-crisis","description":"Product-safety/quality failures, executive misconduct, data breaches, adverse media, or viral social-media/activist campaigns erode customer trust, investor confidence, partnerships, and brand equity — with long-term value loss exceeding near-term financial impact.","details":{"category":"reputational","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"reputational-brand-crisis","taxonomies":["enterprise-risk","coso-erm-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-reputational-brand-crisis-4d7c293d.html","id":"risk:reputational-brand-crisis","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Areputational-brand-crisis","sourceIds":["coso-erm","coso-ic","gdpr","nis2","nist-800-53","nist-csf-2","nydfs-500","soc2","sox"],"sourceUrl":null,"title":"Brand and reputational crisis","type":"risk","url":"/assets/agent_record-risk-reputational-brand-crisis-4d7c293d.ca86d666a4dadafe.json"},{"attributes":{"category":"reputational","domain":["Governance, Policy & Oversight","Risk Assessment & Management"],"inherent_rating":"medium","taxonomy":["coso-erm-risk","enterprise-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Areputational-stakeholder-trust","description":"Gradual loss of trust and social license among customers, employees, investors, regulators, and communities — from perceived values misalignment, poor ESG/governance conduct, or repeated service failures — weakening stakeholder relationships and long-term enterprise value even absent a single acute crisis.","details":{"category":"reputational","impact":"medium","inherent_rating":"medium","likelihood":"medium","risk_id":"reputational-stakeholder-trust","taxonomies":["coso-erm-risk","enterprise-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-reputational-stakeholder-trust-23d21e70.html","id":"risk:reputational-stakeholder-trust","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Areputational-stakeholder-trust","sourceIds":["cobit-2019","coso-erm","coso-ic","gdpr","iia-pos-2026-erm","iia-pos-2026-three-lines","iso-31000","nist-800-53","nist-csf-2","soc2","sox"],"sourceUrl":null,"title":"Stakeholder trust and social-license erosion","type":"risk","url":"/assets/agent_record-risk-reputational-stakeholder-trust-23d21e70.cc84ea3ea3c8507a.json"},{"attributes":{"category":"operational","domain":["Risk Assessment & Management","Governance, Policy & Oversight"],"inherent_rating":"high","taxonomy":["coso-erm-risk","enterprise-risk","nist-privacy-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Arisk-assessment-inadequate","description":"No systematic process to identify, analyse, evaluate, and treat risk — including missing fraud-risk assessment and no ongoing risk monitoring — leaving material exposures unidentified and untreated before they materialise.","details":{"category":"operational","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"risk-assessment-inadequate","taxonomies":["coso-erm-risk","enterprise-risk","nist-privacy-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-risk-assessment-inadequate-328128b5.html","id":"risk:risk-assessment-inadequate","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Arisk-assessment-inadequate","sourceIds":["cobit-2019","coso-erm","coso-ic","eu-ai-act","iso-31000","nist-800-53","nist-csf-2","nydfs-500","soc2","sox"],"sourceUrl":null,"title":"Inadequate or absent risk assessment process","type":"risk","url":"/assets/agent_record-risk-risk-assessment-inadequate-328128b5.d129815d96ef1693.json"}],"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:04d838a2ebd498b71989710ebb6e860e4c16b5116cc025be852189625f8c67c8","properties":{"rationale":"Selecting and developing control activities and general technology controls (COSO P10/P11) directly builds the control environment.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-access-15-84699cae.json","sourceId":"uc:UC-ACCESS-15","targetDetailPath":"/data/v1/records/risk-gov-weak-internal-control-7acb9117.json","targetId":"risk:gov-weak-internal-control","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:08901f92f139567733352fa9c46f6b8381406d516a043727a779bb251a871be5","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-ic-p5-7f62f522.json","sourceId":"ctrl:coso-ic:P5","targetDetailPath":"/data/v1/records/std-coso-ic-3f80f565.json","targetId":"std:coso-ic","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:0be2c34465b299c94ca6af1affeb773f61d4e88ba0a1046a45cab8dd13a7a1aa","properties":{"control_id":"P9","coverage":"full","delta":null,"framework":"coso-ic","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2013"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-11-3f5d23ea.json","sourceId":"uc:UC-RISK-11","targetDetailPath":"/data/v1/records/ctrl-coso-ic-p9-8a96cb71.json","targetId":"ctrl:coso-ic:P9","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:12be2c89e1e9f3b74f3530581699695bd6b9389c77b4aa2abf3bd7684f527054","properties":{"rationale":"","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-06-f1eb1346.json","sourceId":"uc:UC-GOV-06","targetDetailPath":"/data/v1/records/risk-ops-core-process-inefficiency-8e830edd.json","targetId":"risk:ops-core-process-inefficiency","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:231c1989392043534ae70b45cf09c27b9dc697ce2c68633883243fdeea4b67e5","properties":{"rationale":"Defining and assigning security roles, responsibilities, and authorities directly remedies undefined roles and duties.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-06-f1eb1346.json","sourceId":"uc:UC-GOV-06","targetDetailPath":"/data/v1/records/risk-gov-policy-absent-cf76dbbf.json","targetId":"risk:gov-policy-absent","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2a254c4455b8b44db615085689669bef86efe814f514a6d0bceeb9b010556e2c","properties":{"rationale":"Regular CAE-to-board communication on control and assurance matters gives the board information it needs to oversee risk and control.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-18-7ab55995.json","sourceId":"uc:UC-AUDIT-18","targetDetailPath":"/data/v1/records/risk-gov-oversight-failure-d98ffc12.json","targetId":"risk:gov-oversight-failure","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2d8557480c52ad380a7c58fe80f500f44daf5311d37b2a0eab646aa8adfa0974","properties":{"control_id":"P16","coverage":"full","delta":null,"framework":"coso-ic","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2013"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-21-6406caa4.json","sourceId":"uc:UC-AUDIT-21","targetDetailPath":"/data/v1/records/ctrl-coso-ic-p16-4995bb68.json","targetId":"ctrl:coso-ic:P16","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:32694e30478209160ff2ffd85d0919d0799eccbca09a9261a32fd415b04e2757","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-ic-p14-4f2da7a2.json","sourceId":"ctrl:coso-ic:P14","targetDetailPath":"/data/v1/records/std-coso-ic-3f80f565.json","targetId":"std:coso-ic","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:32ebdf77cd39fd0171fbda283129683cd51cf83bf6c6b996486f8faad94bbed9","properties":{"rationale":"General controls over technology access underpin the ITGC layer supporting reliable financial reporting.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-access-15-84699cae.json","sourceId":"uc:UC-ACCESS-15","targetDetailPath":"/data/v1/records/risk-fin-icfr-material-weakness-cdd66323.json","targetId":"risk:fin-icfr-material-weakness","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:3ca60babefbe4859cb18c547ec062fd1e55efbe54db55980034fd45c3b5fd5fa","properties":{"rationale":"Ongoing and separate assessments of controls, with deficiencies routed for corrective action, directly detect and remediate a weak control environment.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-21-6406caa4.json","sourceId":"uc:UC-AUDIT-21","targetDetailPath":"/data/v1/records/risk-gov-weak-internal-control-7acb9117.json","targetId":"risk:gov-weak-internal-control","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:3f20ac84d57f6fc3147a14ecb7f441b37893c6231eb7e5cfe210b41db70ae38c","properties":{"rationale":"Tone at the top, ethics, and an adopted code of conduct are the control-environment foundation the risk names as poor.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-04-849a3e91.json","sourceId":"uc:UC-GOV-04","targetDetailPath":"/data/v1/records/risk-gov-weak-internal-control-7acb9117.json","targetId":"risk:gov-weak-internal-control","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:400f70c551f11263d174c3150339cb30cd22c365dcf230821bec670279b89c6e","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-ic-p15-04537dd0.json","sourceId":"ctrl:coso-ic:P15","targetDetailPath":"/data/v1/records/std-coso-ic-3f80f565.json","targetId":"std:coso-ic","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:404449c161c2b2e1eb98e5875c84937f0cb1f6cb211b8cf3fe87f135c184d0cd","properties":{"rationale":"The data/information inventory component contributes to overall asset accountability; the systems inventory itself is UC-01.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-asset-02-6c6ac61b.json","sourceId":"uc:UC-ASSET-02","targetDetailPath":"/data/v1/records/risk-asset-inventory-gap-e18c7e73.json","targetId":"risk:asset-inventory-gap","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:44d020fec45fd9e556c9f8bdb1cc1c2e0dbeace4d4dec22b3303ff1fe1182c3b","properties":{"rationale":"Monitoring that assesses control design/operating effectiveness and evaluates and communicates deficiencies (SOX ELC-MON, COSO P16) detects undetected ICFR weaknesses.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-21-6406caa4.json","sourceId":"uc:UC-AUDIT-21","targetDetailPath":"/data/v1/records/risk-fin-icfr-material-weakness-cdd66323.json","targetId":"risk:fin-icfr-material-weakness","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:46aa39a4ea46095a7cf37e080fc784c4480c2b0ec372694e0227c4b9c014074a","properties":{"control_id":"P7","coverage":"full","delta":null,"framework":"coso-ic","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2013"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-06-e9599494.json","sourceId":"uc:UC-RISK-06","targetDetailPath":"/data/v1/records/ctrl-coso-ic-p7-a272f700.json","targetId":"ctrl:coso-ic:P7","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:4efa7d9e4b72a7a5cb24975d635877780620644632caa229ee42ad89a0c6db3a","properties":{"rationale":"Demonstrated integrity and core values counter the perceived values-misalignment that erodes stakeholder trust.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-04-849a3e91.json","sourceId":"uc:UC-GOV-04","targetDetailPath":"/data/v1/records/risk-reputational-stakeholder-trust-23d21e70.json","targetId":"risk:reputational-stakeholder-trust","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:4fbd0e215c1b15c1eb800748ac761da0d2bf0dde577c169240443ff9cdc16c9f","properties":{"rationale":"Reporting to external stakeholders on risk and performance sustains stakeholder relationships and trust.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-21-8c5d79f9.json","sourceId":"uc:UC-GOV-21","targetDetailPath":"/data/v1/records/risk-reputational-stakeholder-trust-23d21e70.json","targetId":"risk:reputational-stakeholder-trust","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:50103a665d87e681087a60cc9fdd545ff3ee3a107fa851f5fdb59a302a009ec3","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-ic-p3-8a6c14d5.json","sourceId":"ctrl:coso-ic:P3","targetDetailPath":"/data/v1/records/std-coso-ic-3f80f565.json","targetId":"std:coso-ic","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:521a89a1ca7581bbd368a446574c3a54f920420d19d82a0f4a5512f7200a8cd7","properties":{"control_id":"P13","coverage":"partial","delta":"COSO expects quality information supporting all internal control components","framework":"coso-ic","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2013"},"sourceDetailPath":"/data/v1/records/uc-uc-asset-02-6c6ac61b.json","sourceId":"uc:UC-ASSET-02","targetDetailPath":"/data/v1/records/ctrl-coso-ic-p13-0c70843b.json","targetId":"ctrl:coso-ic:P13","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:522d28aed24ab32fe41449ac950acc152ef604cf0a9e3b0e0aee1ab0b91027e2","properties":{"control_id":"P5","coverage":"full","delta":null,"framework":"coso-ic","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2013"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-07-2a8998f7.json","sourceId":"uc:UC-GOV-07","targetDetailPath":"/data/v1/records/ctrl-coso-ic-p5-7f62f522.json","targetId":"ctrl:coso-ic:P5","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:5281390054b41163d7d644d1c520e88598f1a899f13fd5818c8d8839e14fa9c3","properties":{"rationale":"Board independence, expertise, and oversight of the control and risk program is the direct control against inadequate board oversight.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-05-b3a47944.json","sourceId":"uc:UC-GOV-05","targetDetailPath":"/data/v1/records/risk-gov-oversight-failure-d98ffc12.json","targetId":"risk:gov-oversight-failure","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:55d98f71337b6a07fdde1ba619995d8b78c179bbbb0d05e658965b71a4099f89","properties":{"rationale":"Leadership demonstrating integrity and a risk-aware culture directly addresses the unclear tone at the top driving oversight failure.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-04-849a3e91.json","sourceId":"uc:UC-GOV-04","targetDetailPath":"/data/v1/records/risk-gov-oversight-failure-d98ffc12.json","targetId":"risk:gov-oversight-failure","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:5868785f2387ea5e5baf5f8d80fdbe1d23749713f245e3a69e8790c3536e9c2e","properties":{"control_id":"P1","coverage":"full","delta":null,"framework":"coso-ic","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2013"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-04-849a3e91.json","sourceId":"uc:UC-GOV-04","targetDetailPath":"/data/v1/records/ctrl-coso-ic-p1-f41d97ed.json","targetId":"ctrl:coso-ic:P1","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:5e326730f8ab2cb1e2ab11f630ba19a793966e4dac100e3e7d4d1a544232f1fc","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-ic-p16-4995bb68.json","sourceId":"ctrl:coso-ic:P16","targetDetailPath":"/data/v1/records/std-coso-ic-3f80f565.json","targetId":"std:coso-ic","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:5ffb88ce652506ecf84fb88b264d0eb42d61ca1f72fd14d38745d836f4be9592","properties":{"rationale":"NYDFS 500.9 member and explicit cyber scope make the assessment periodically surface evolving cyber threats for treatment, enabling context not the operative defense.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-06-e9599494.json","sourceId":"uc:UC-RISK-06","targetDetailPath":"/data/v1/records/risk-cyber-adversary-threat-sources-fa9e3003.json","targetId":"risk:cyber-adversary-threat-sources","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:63ebbbc35c597cf5bba4e4837a4cc9c058bcb3a4ba923205f09d8b39c4d950f0","properties":{"rationale":"An ethical culture, code of conduct, and disciplinary follow-through deter the rationalization leg of insider fraud.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-04-849a3e91.json","sourceId":"uc:UC-GOV-04","targetDetailPath":"/data/v1/records/risk-fraud-internal-misappropriation-d235cd10.json","targetId":"risk:fraud-internal-misappropriation","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:65c095cf3ce978ff7a07fc0cb45cf636cf2fc931ce86429df16da655bc187122","properties":{"rationale":"Consistent ethical leadership behavior reduces executive-misconduct triggers of brand crises.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-04-849a3e91.json","sourceId":"uc:UC-GOV-04","targetDetailPath":"/data/v1/records/risk-reputational-brand-crisis-4d7c293d.json","targetId":"risk:reputational-brand-crisis","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:67a81d9aca89e4727d57d92fc43b1c8cbe3b0c88584059ee23fb1534698bdc32","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-ic-p13-0c70843b.json","sourceId":"ctrl:coso-ic:P13","targetDetailPath":"/data/v1/records/std-coso-ic-3f80f565.json","targetId":"std:coso-ic","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:6e4a82ac5680b85a4a0a1b293996eefad4f8970f2b0ec15e7c53c155b25a3b7d","properties":{"control_id":"P2","coverage":"full","delta":null,"framework":"coso-ic","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2013"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-05-b3a47944.json","sourceId":"uc:UC-GOV-05","targetDetailPath":"/data/v1/records/ctrl-coso-ic-p2-4f80775c.json","targetId":"ctrl:coso-ic:P2","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:6ecddf3dfc0606d5faa60338779f21b6e6ce0b511273bf6699b901a79b8b0f64","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-ic-p1-f41d97ed.json","sourceId":"ctrl:coso-ic:P1","targetDetailPath":"/data/v1/records/std-coso-ic-3f80f565.json","targetId":"std:coso-ic","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:73c1e2950e16821930d708b7ad25bf221676650298d136c8d0c766599b260715","properties":{"control_id":"P17","coverage":"partial","delta":"covers all internal-control deficiencies, beyond incident-derived lessons","framework":"coso-ic","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2013"},"sourceDetailPath":"/data/v1/records/uc-uc-ir-10-072c0403.json","sourceId":"uc:UC-IR-10","targetDetailPath":"/data/v1/records/ctrl-coso-ic-p17-277098f3.json","targetId":"ctrl:coso-ic:P17","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:752575973f408428ecdab2255da7065768c9873e1533285b323787a612c45118","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-ic-p12-233c8710.json","sourceId":"ctrl:coso-ic:P12","targetDetailPath":"/data/v1/records/std-coso-ic-3f80f565.json","targetId":"std:coso-ic","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7a9ed82b78b92593ba2e35df42ddd1e931e7239c55b1217a1e239d67653b158a","properties":{"rationale":"Converting post-incident lessons into corrective actions improves procedures over time — a second-order feedback loop presupposing the base procedures, not the operative defense against their absence.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-ir-10-072c0403.json","sourceId":"uc:UC-IR-10","targetDetailPath":"/data/v1/records/risk-ir-no-response-procedures-90eb7ba1.json","targetId":"risk:ir-no-response-procedures","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7d9b46f4ba37a47597f9c40d452679ab297a9578396b2d0fbd5ed75390fc7366","properties":{"rationale":"Documented rules of behavior and disciplinary consequences for violations supply the deterrent and disciplinary process the risk lacks.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-07-2a8998f7.json","sourceId":"uc:UC-GOV-07","targetDetailPath":"/data/v1/records/risk-hr-missing-security-terms-discipline-0a47163d.json","targetId":"risk:hr-missing-security-terms-discipline","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:83e136a1f18ac7b92e27bb2448dc3cc6c17ecab0f55475fb78cd384b1480466b","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-ic-p2-4f80775c.json","sourceId":"ctrl:coso-ic:P2","targetDetailPath":"/data/v1/records/std-coso-ic-3f80f565.json","targetId":"std:coso-ic","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:8846a3876f3031f025badfe8e50998bdfeb21e5875852c8e41a301de7d4ac2cc","properties":{"rationale":"Fraud risk assessment plus anti-override controls (journal-entry and significant-estimate review) directly detect and deter employee embezzlement, forgery and unauthorized disbursements.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-12-210e108b.json","sourceId":"uc:UC-RISK-12","targetDetailPath":"/data/v1/records/risk-fraud-internal-misappropriation-d235cd10.json","targetId":"risk:fraud-internal-misappropriation","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:89a8daad09cbe7d2d73e348c5f242203fcf030baf4354c979f89107eab43fc1a","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-ic-p4-8da1f64c.json","sourceId":"ctrl:coso-ic:P4","targetDetailPath":"/data/v1/records/std-coso-ic-3f80f565.json","targetId":"std:coso-ic","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:8a42451d0b65b2f78abe66a322743070f045bb0d4cc748770959deed39bbcaf0","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-ic-p11-2a08883b.json","sourceId":"ctrl:coso-ic:P11","targetDetailPath":"/data/v1/records/std-coso-ic-3f80f565.json","targetId":"std:coso-ic","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:8ab3a0394bc8de1f7ceb8cfab9bb4f44896298d1cf0afb0917732b81cafdc012","properties":{"control_id":"P14","coverage":"full","delta":null,"framework":"coso-ic","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2013"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-21-8c5d79f9.json","sourceId":"uc:UC-GOV-21","targetDetailPath":"/data/v1/records/ctrl-coso-ic-p14-4f2da7a2.json","targetId":"ctrl:coso-ic:P14","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:8bdbde7107215d576d6eb3768027a92d2ebe8927bfd8d582b94f3c82ea69844c","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-ic-p17-277098f3.json","sourceId":"ctrl:coso-ic:P17","targetDetailPath":"/data/v1/records/std-coso-ic-3f80f565.json","targetId":"std:coso-ic","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:8c8c2c558ba80f799bbb8c460d8546fc699d686b29c1e141592377c52ef1f713","properties":{"control_id":"P3","coverage":"full","delta":null,"framework":"coso-ic","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2013"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-06-f1eb1346.json","sourceId":"uc:UC-GOV-06","targetDetailPath":"/data/v1/records/ctrl-coso-ic-p3-8a6c14d5.json","targetId":"ctrl:coso-ic:P3","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:8cffd54d2a669546e3e6de1f6dea63838956e2c961d1ad376bbdf876dd21ed07","properties":{"rationale":"Documenting configuration-management processes and roles enables disciplined change control, but executing change management is the operative defense.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-config-09-3da3afe2.json","sourceId":"uc:UC-CONFIG-09","targetDetailPath":"/data/v1/records/risk-config-weak-change-control-e7d90eaf.json","targetId":"risk:config-weak-change-control","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:8f00b3af18bd976ece45fa4f771f6deb906c8ac51a41df201a46be8c80fdd8ca","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-ic-p7-a272f700.json","sourceId":"ctrl:coso-ic:P7","targetDetailPath":"/data/v1/records/std-coso-ic-3f80f565.json","targetId":"std:coso-ic","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:90878588df00f7d57db2d579ea31b5def525f8d552d2053df6dcd6a98660c2f3","properties":{"rationale":"Control explicitly assesses regulatory changes for risk impact; early detection of adverse law/policy change enables timely, less costly adaptation.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-11-3f5d23ea.json","sourceId":"uc:UC-RISK-11","targetDetailPath":"/data/v1/records/risk-compliance-regulatory-policy-change-9429f25b.json","targetId":"risk:compliance-regulatory-policy-change","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9301ca2d3b6247b77f710c9a4e2ab2d8e34007516a7bf2c7a06e1e0ae25041e9","properties":{"rationale":"Holding individuals accountable for control responsibilities (COSO P5) directly strengthens the control environment.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-07-2a8998f7.json","sourceId":"uc:UC-GOV-07","targetDetailPath":"/data/v1/records/risk-gov-weak-internal-control-7acb9117.json","targetId":"risk:gov-weak-internal-control","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:951f198617fd4e6985371dc92e0a4c9ef65a0e645d8465f2002e7785532ca2a6","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-ic-p8-e85b1bf7.json","sourceId":"ctrl:coso-ic:P8","targetDetailPath":"/data/v1/records/std-coso-ic-3f80f565.json","targetId":"std:coso-ic","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9d6b9b606b485c90a839a57bafe230a44e306f127a95e429e71bf0c9216880aa","properties":{"control_id":"P15","coverage":"partial","delta":"entity-wide external channels (whistleblower, customers, suppliers) beyond assurance stakeholders","framework":"coso-ic","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2013"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-18-7ab55995.json","sourceId":"uc:UC-AUDIT-18","targetDetailPath":"/data/v1/records/ctrl-coso-ic-p15-04537dd0.json","targetId":"ctrl:coso-ic:P15","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a03a6c886e769fac0436dc1b51e316365b4763858182610cc4965151db1907f1","properties":{"rationale":"A documented CM plan defining how configuration items are identified and managed is the foundation enabling baseline control, but not the operative drift defense.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-config-09-3da3afe2.json","sourceId":"uc:UC-CONFIG-09","targetDetailPath":"/data/v1/records/risk-config-poor-baseline-drift-2dd66324.json","targetId":"risk:config-poor-baseline-drift","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a0887b53aed259e28429576545e1992b4afb34046c08213b939b0636474f65ed","properties":{"control_id":"P4","coverage":"full","delta":null,"framework":"coso-ic","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2013"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-10-016614d1.json","sourceId":"uc:UC-GOV-10","targetDetailPath":"/data/v1/records/ctrl-coso-ic-p4-8da1f64c.json","targetId":"ctrl:coso-ic:P4","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a4da889c3e8d9a23cacd902b671a9a5be1365ce9c64cb898768e45d8f0589034","properties":{"control_id":"P8","coverage":"full","delta":null,"framework":"coso-ic","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2013"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-12-210e108b.json","sourceId":"uc:UC-RISK-12","targetDetailPath":"/data/v1/records/ctrl-coso-ic-p8-e85b1bf7.json","targetId":"ctrl:coso-ic:P8","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a69d357cd19c13d44567d4318ca1862b4b8b09a41535dbfdc7fea1093ab236f5","properties":{"rationale":"Journal-entry and precision estimate review detect the mismarking and fictitious bookings used to conceal unauthorized/rogue positions (complements trading-limit controls).","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-12-210e108b.json","sourceId":"uc:UC-RISK-12","targetDetailPath":"/data/v1/records/risk-fraud-unauthorized-trading-activity-e5d9d4b9.json","targetId":"risk:fraud-unauthorized-trading-activity","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a8d701934e20627e2031ea822b66a45953371b274acf28a0fb1b8c03ef3d4e61","properties":{"rationale":"Specifying objectives and business context clearly is the foundation that makes risk identification and assessment possible; absent it the process is inadequate.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-04-1a2bee69.json","sourceId":"uc:UC-RISK-04","targetDetailPath":"/data/v1/records/risk-risk-assessment-inadequate-328128b5.json","targetId":"risk:risk-assessment-inadequate","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:ad0e3cf5d28f24b95a2da30e0f428b9a4d26bd2d74f219c1209d4dbc84be7283","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-ic-p10-c5a97f20.json","sourceId":"ctrl:coso-ic:P10","targetDetailPath":"/data/v1/records/std-coso-ic-3f80f565.json","targetId":"std:coso-ic","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b762f997b3bc0017c1a025bf61e5f61e921d86e77f588f176f280dc4530d151f","properties":{"rationale":"Performing periodic enterprise-wide risk assessments per a documented methodology directly operates the assessment process the risk describes as absent.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-06-e9599494.json","sourceId":"uc:UC-RISK-06","targetDetailPath":"/data/v1/records/risk-risk-assessment-inadequate-328128b5.json","targetId":"risk:risk-assessment-inadequate","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:bb9ab1025acf6800c2e99cf9e7284c0062c5e338301e2c4cd9b5ed13424002f2","properties":{"rationale":"Maintaining data inventories, RoPA, and data-flow diagrams directly produces the authoritative data-flow record this risk says is absent.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-asset-02-6c6ac61b.json","sourceId":"uc:UC-ASSET-02","targetDetailPath":"/data/v1/records/risk-data-inventory-flows-unmapped-fd7746f8.json","targetId":"risk:data-inventory-flows-unmapped","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:bd98758e685f20b10abe90de0b6f384856fc8fce6766450f55a92357c6260407","properties":{"rationale":"","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-06-e9599494.json","sourceId":"uc:UC-RISK-06","targetDetailPath":"/data/v1/records/risk-financial-liquidity-capital-e0ac2d24.json","targetId":"risk:financial-liquidity-capital","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:bf07ea55fc952704c5d303cbd5c6caf2fbdf32cd3874064dffdbd61f4f97d0f3","properties":{"rationale":"Access control activities limiting unauthorized access reduce opportunity for insider misappropriation.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-access-15-84699cae.json","sourceId":"uc:UC-ACCESS-15","targetDetailPath":"/data/v1/records/risk-fraud-internal-misappropriation-d235cd10.json","targetId":"risk:fraud-internal-misappropriation","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:c31e4b50fafba2cf167463df61830631e526fda4a33a1057fdacfa967b6f0c6e","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-ic-p6-e614a304.json","sourceId":"ctrl:coso-ic:P6","targetDetailPath":"/data/v1/records/std-coso-ic-3f80f565.json","targetId":"std:coso-ic","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:cb4bb91299330aba65c724847882f00b89cc0fa6a325e17292b684496c582f1b","properties":{"control_id":"P11","coverage":"partial","delta":"principle applies across all technology domains, not only access","framework":"coso-ic","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2013"},"sourceDetailPath":"/data/v1/records/uc-uc-access-15-84699cae.json","sourceId":"uc:UC-ACCESS-15","targetDetailPath":"/data/v1/records/ctrl-coso-ic-p11-2a08883b.json","targetId":"ctrl:coso-ic:P11","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:cda48ad4d1dec1640413617ad43f47543331ae1078834e438135c46b7c8195d3","properties":{"rationale":"Accountability, performance incentives, and disciplinary consequences deter insider misappropriation.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-07-2a8998f7.json","sourceId":"uc:UC-GOV-07","targetDetailPath":"/data/v1/records/risk-fraud-internal-misappropriation-d235cd10.json","targetId":"risk:fraud-internal-misappropriation","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d51e0c2cff0f07ea472ce919c8211ae63ac98498cba09607ba2ea89d79975ebe","properties":{"rationale":"Board/audit-committee oversight of internal control provides challenge that helps surface ICFR material weaknesses.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-05-b3a47944.json","sourceId":"uc:UC-GOV-05","targetDetailPath":"/data/v1/records/risk-fin-icfr-material-weakness-cdd66323.json","targetId":"risk:fin-icfr-material-weakness","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:db5f4ea733e0e68a13d0d5ee1bee8da00daecc29d4afbdbb597aba4a4e159533","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-coso-ic-p9-8a96cb71.json","sourceId":"ctrl:coso-ic:P9","targetDetailPath":"/data/v1/records/std-coso-ic-3f80f565.json","targetId":"std:coso-ic","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:dc58a262b9c5130739984b7631650a439ee6b18ce8a57263d9b917ac82a47ad5","properties":{"control_id":"P10","coverage":"partial","delta":"principle applies across all control domains, not only access","framework":"coso-ic","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2013"},"sourceDetailPath":"/data/v1/records/uc-uc-access-15-84699cae.json","sourceId":"uc:UC-ACCESS-15","targetDetailPath":"/data/v1/records/ctrl-coso-ic-p10-c5a97f20.json","targetId":"ctrl:coso-ic:P10","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:dedfeda0215936ef31af34a08f2908e9c400ce2d90ffe55ac0144852df78cc3c","properties":{"rationale":"","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-18-7ab55995.json","sourceId":"uc:UC-AUDIT-18","targetDetailPath":"/data/v1/records/risk-esg-social-human-rights-1dbeca21.json","targetId":"risk:esg-social-human-rights","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:df828e368b0a23a5acecc6ce5395ac5ad255b9d77edea108c86286b234be8586","properties":{"control_id":"P6","coverage":"full","delta":null,"framework":"coso-ic","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2013"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-04-1a2bee69.json","sourceId":"uc:UC-RISK-04","targetDetailPath":"/data/v1/records/ctrl-coso-ic-p6-e614a304.json","targetId":"ctrl:coso-ic:P6","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:eb4584970a3d10a43b8e6b52a71626665c9a47c8f2baca3126259e6676457b3c","properties":{"rationale":"Independent testing of control operating effectiveness can detect management override and fraudulent transactions.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-21-6406caa4.json","sourceId":"uc:UC-AUDIT-21","targetDetailPath":"/data/v1/records/risk-fin-financial-statement-fraud-1dd35d5a.json","targetId":"risk:fin-financial-statement-fraud","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:eebb25824b119480fac503dfc8b7fdf958ae3a5a04b670ecc90af14051e65c42","properties":{"rationale":"Workforce planning, retention, and succession planning directly reduce the talent-departure loss of capacity the risk names.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-10-016614d1.json","sourceId":"uc:UC-GOV-10","targetDetailPath":"/data/v1/records/risk-gov-organizational-change-resistance-a8383ccb.json","targetId":"risk:gov-organizational-change-resistance","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:eebc23cf930fc9d7924ffdcc9d469b6529907a8bd31cb525dda6b67b31ebb4a5","properties":{"rationale":"","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-21-8c5d79f9.json","sourceId":"uc:UC-GOV-21","targetDetailPath":"/data/v1/records/risk-fin-crime-aml-sanctions-80b15201.json","targetId":"risk:fin-crime-aml-sanctions","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:fc798f57020128c2304ced9e83b5e2bc542716be475a026d320e85ef491f566a","properties":{"control_id":"P12","coverage":"partial","delta":"COSO expects policies and procedures deploying all control activities, not only CM","framework":"coso-ic","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2013"},"sourceDetailPath":"/data/v1/records/uc-uc-config-09-3da3afe2.json","sourceId":"uc:UC-CONFIG-09","targetDetailPath":"/data/v1/records/ctrl-coso-ic-p12-233c8710.json","targetId":"ctrl:coso-ic:P12","type":"maps_to"}],"schemaVersion":1,"scope":"sources","total":124}