{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","contextIds":["risk:ai-environmental-footprint","risk:ai-inaccurate-unreliable-output","risk:ai-power-concentration-societal","risk:ai-safety-harm-to-people","risk:compliance-client-suitability-fiduciary","risk:compliance-regulatory-policy-change","risk:cyber-adversary-threat-sources","risk:fin-crime-aml-sanctions","risk:financial-credit-market-risk","risk:financial-liquidity-capital","risk:gov-project-change-management","risk:ops-counterparty-settlement-disputes","risk:ops-documentation-account-management","risk:ops-product-service-quality","risk:reputational-stakeholder-trust","risk:risk-assessment-inadequate","risk:strategic-concentration","risk:strategic-disruption-substitution"],"directIds":["ctrl:iso-31000:31000-FW1","ctrl:iso-31000:31000-FW2","ctrl:iso-31000:31000-FW3","ctrl:iso-31000:31000-FW4","ctrl:iso-31000:31000-FW5","ctrl:iso-31000:31000-FW6","ctrl:iso-31000:31000-P1","ctrl:iso-31000:31000-P2","ctrl:iso-31000:31000-P3","ctrl:iso-31000:31000-P4","ctrl:iso-31000:31000-P5","ctrl:iso-31000:31000-P6","ctrl:iso-31000:31000-P7","ctrl:iso-31000:31000-P8","ctrl:iso-31000:31000-PR1","ctrl:iso-31000:31000-PR2","ctrl:iso-31000:31000-PR3","ctrl:iso-31000:31000-PR4","ctrl:iso-31000:31000-PR5","ctrl:iso-31000:31000-PR6","ctrl:iso-31000:31000-PR7","ctrl:iso-31000:31000-PR8"],"kind":"bundle","metadata":"/assets/agent_metadata.5c7612c9c5b0b455.json","name":"ISO 31000:2018","next":"/assets/agent_sources-iso-31000-2.a42c33684cdc5aa9.json","page":1,"pageSize":40,"records":[{"attributes":{"category":"administrative","framework":"iso-31000","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-31000/","description":"Leadership and commitment","details":{"automation":"manual","control_category":"administrative","control_id":"31000-FW1","control_type":"preventive","domains":["Risk Assessment & Management","Governance, Policy & Oversight"],"framework":"iso-31000","group":"Framework","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-iso-31000-31000-fw1-112c0ed5.html","id":"ctrl:iso-31000:31000-FW1","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-31000%3A31000-FW1","sourceIds":["iso-31000"],"sourceUrl":null,"title":"31000-FW1 — Leadership and commitment","type":"control","url":"/assets/agent_record-ctrl-iso-31000-31000-fw1-112c0ed5.9d5ed649d04d45c5.json"},{"attributes":{"category":"administrative","framework":"iso-31000","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-31000/","description":"Integration","details":{"automation":"manual","control_category":"administrative","control_id":"31000-FW2","control_type":"preventive","domains":["Risk Assessment & Management","Governance, Policy & Oversight"],"framework":"iso-31000","group":"Framework","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-iso-31000-31000-fw2-002ea142.html","id":"ctrl:iso-31000:31000-FW2","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-31000%3A31000-FW2","sourceIds":["iso-31000"],"sourceUrl":null,"title":"31000-FW2 — Integration","type":"control","url":"/assets/agent_record-ctrl-iso-31000-31000-fw2-002ea142.c44dc2e71eef2f59.json"},{"attributes":{"category":"administrative","framework":"iso-31000","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-31000/","description":"Design","details":{"automation":"manual","control_category":"administrative","control_id":"31000-FW3","control_type":"preventive","domains":["Risk Assessment & Management","Governance, Policy & Oversight"],"framework":"iso-31000","group":"Framework","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-iso-31000-31000-fw3-21cc689c.html","id":"ctrl:iso-31000:31000-FW3","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-31000%3A31000-FW3","sourceIds":["iso-31000"],"sourceUrl":null,"title":"31000-FW3 — Design","type":"control","url":"/assets/agent_record-ctrl-iso-31000-31000-fw3-21cc689c.e11bfc07e536e973.json"},{"attributes":{"category":"administrative","framework":"iso-31000","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-31000/","description":"Implementation","details":{"automation":"manual","control_category":"administrative","control_id":"31000-FW4","control_type":"preventive","domains":["Risk Assessment & Management","Governance, Policy & Oversight"],"framework":"iso-31000","group":"Framework","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-iso-31000-31000-fw4-b350dbe6.html","id":"ctrl:iso-31000:31000-FW4","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-31000%3A31000-FW4","sourceIds":["iso-31000"],"sourceUrl":null,"title":"31000-FW4 — Implementation","type":"control","url":"/assets/agent_record-ctrl-iso-31000-31000-fw4-b350dbe6.5df69d898d23a7c8.json"},{"attributes":{"category":"administrative","framework":"iso-31000","type":"detective"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-31000/","description":"Evaluation","details":{"automation":"manual","control_category":"administrative","control_id":"31000-FW5","control_type":"detective","domains":["Risk Assessment & Management","Governance, Policy & Oversight"],"framework":"iso-31000","group":"Framework","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-iso-31000-31000-fw5-2768e6fc.html","id":"ctrl:iso-31000:31000-FW5","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-31000%3A31000-FW5","sourceIds":["iso-31000"],"sourceUrl":null,"title":"31000-FW5 — Evaluation","type":"control","url":"/assets/agent_record-ctrl-iso-31000-31000-fw5-2768e6fc.e760930faf275a4a.json"},{"attributes":{"category":"administrative","framework":"iso-31000","type":"corrective"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-31000/","description":"Improvement","details":{"automation":"manual","control_category":"administrative","control_id":"31000-FW6","control_type":"corrective","domains":["Risk Assessment & Management","Governance, Policy & Oversight"],"framework":"iso-31000","group":"Framework","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-iso-31000-31000-fw6-caaa68bb.html","id":"ctrl:iso-31000:31000-FW6","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-31000%3A31000-FW6","sourceIds":["iso-31000"],"sourceUrl":null,"title":"31000-FW6 — Improvement","type":"control","url":"/assets/agent_record-ctrl-iso-31000-31000-fw6-caaa68bb.a771670cb7a3c909.json"},{"attributes":{"category":"administrative","framework":"iso-31000","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-31000/","description":"Integrated","details":{"automation":"manual","control_category":"administrative","control_id":"31000-P1","control_type":"preventive","domains":["Risk Assessment & Management","Governance, Policy & Oversight"],"framework":"iso-31000","group":"Principles","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-iso-31000-31000-p1-ee160f4d.html","id":"ctrl:iso-31000:31000-P1","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-31000%3A31000-P1","sourceIds":["iso-31000"],"sourceUrl":null,"title":"31000-P1 — Integrated","type":"control","url":"/assets/agent_record-ctrl-iso-31000-31000-p1-ee160f4d.3957b9df465821bb.json"},{"attributes":{"category":"administrative","framework":"iso-31000","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-31000/","description":"Structured and comprehensive","details":{"automation":"manual","control_category":"administrative","control_id":"31000-P2","control_type":"preventive","domains":["Risk Assessment & Management","Governance, Policy & Oversight"],"framework":"iso-31000","group":"Principles","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-iso-31000-31000-p2-48e44995.html","id":"ctrl:iso-31000:31000-P2","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-31000%3A31000-P2","sourceIds":["iso-31000"],"sourceUrl":null,"title":"31000-P2 — Structured and comprehensive","type":"control","url":"/assets/agent_record-ctrl-iso-31000-31000-p2-48e44995.be22c18bcf5c1542.json"},{"attributes":{"category":"administrative","framework":"iso-31000","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-31000/","description":"Customized","details":{"automation":"manual","control_category":"administrative","control_id":"31000-P3","control_type":"preventive","domains":["Risk Assessment & Management","Governance, Policy & Oversight"],"framework":"iso-31000","group":"Principles","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-iso-31000-31000-p3-fda14ae5.html","id":"ctrl:iso-31000:31000-P3","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-31000%3A31000-P3","sourceIds":["iso-31000"],"sourceUrl":null,"title":"31000-P3 — Customized","type":"control","url":"/assets/agent_record-ctrl-iso-31000-31000-p3-fda14ae5.bbeaab97487b2dac.json"},{"attributes":{"category":"administrative","framework":"iso-31000","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-31000/","description":"Inclusive","details":{"automation":"manual","control_category":"administrative","control_id":"31000-P4","control_type":"preventive","domains":["Risk Assessment & Management","Governance, Policy & Oversight"],"framework":"iso-31000","group":"Principles","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-iso-31000-31000-p4-400c4417.html","id":"ctrl:iso-31000:31000-P4","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-31000%3A31000-P4","sourceIds":["iso-31000"],"sourceUrl":null,"title":"31000-P4 — Inclusive","type":"control","url":"/assets/agent_record-ctrl-iso-31000-31000-p4-400c4417.cd9e24fa470f6e61.json"},{"attributes":{"category":"administrative","framework":"iso-31000","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-31000/","description":"Dynamic","details":{"automation":"manual","control_category":"administrative","control_id":"31000-P5","control_type":"preventive","domains":["Risk Assessment & Management","Governance, Policy & Oversight"],"framework":"iso-31000","group":"Principles","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":4,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-iso-31000-31000-p5-f7cd76e5.html","id":"ctrl:iso-31000:31000-P5","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-31000%3A31000-P5","sourceIds":["iso-31000"],"sourceUrl":null,"title":"31000-P5 — Dynamic","type":"control","url":"/assets/agent_record-ctrl-iso-31000-31000-p5-f7cd76e5.7c3480838d82459c.json"},{"attributes":{"category":"administrative","framework":"iso-31000","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-31000/","description":"Best available information","details":{"automation":"manual","control_category":"administrative","control_id":"31000-P6","control_type":"preventive","domains":["Risk Assessment & Management","Governance, Policy & Oversight"],"framework":"iso-31000","group":"Principles","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-iso-31000-31000-p6-522c7c23.html","id":"ctrl:iso-31000:31000-P6","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-31000%3A31000-P6","sourceIds":["iso-31000"],"sourceUrl":null,"title":"31000-P6 — Best available information","type":"control","url":"/assets/agent_record-ctrl-iso-31000-31000-p6-522c7c23.eea5c161975bc20d.json"},{"attributes":{"category":"administrative","framework":"iso-31000","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-31000/","description":"Human and cultural factors","details":{"automation":"manual","control_category":"administrative","control_id":"31000-P7","control_type":"preventive","domains":["Risk Assessment & Management","Governance, Policy & Oversight"],"framework":"iso-31000","group":"Principles","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-iso-31000-31000-p7-3d100675.html","id":"ctrl:iso-31000:31000-P7","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-31000%3A31000-P7","sourceIds":["iso-31000"],"sourceUrl":null,"title":"31000-P7 — Human and cultural factors","type":"control","url":"/assets/agent_record-ctrl-iso-31000-31000-p7-3d100675.a2d483f3416b9ee9.json"},{"attributes":{"category":"administrative","framework":"iso-31000","type":"corrective"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-31000/","description":"Continual improvement","details":{"automation":"manual","control_category":"administrative","control_id":"31000-P8","control_type":"corrective","domains":["Risk Assessment & Management","Governance, Policy & Oversight"],"framework":"iso-31000","group":"Principles","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-iso-31000-31000-p8-251dfb3d.html","id":"ctrl:iso-31000:31000-P8","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-31000%3A31000-P8","sourceIds":["iso-31000"],"sourceUrl":null,"title":"31000-P8 — Continual improvement","type":"control","url":"/assets/agent_record-ctrl-iso-31000-31000-p8-251dfb3d.64c2c5fe5dd60cdf.json"},{"attributes":{"category":"administrative","framework":"iso-31000","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-31000/","description":"Communication and consultation","details":{"automation":"manual","control_category":"administrative","control_id":"31000-PR1","control_type":"preventive","domains":["Risk Assessment & Management"],"framework":"iso-31000","group":"Process","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-iso-31000-31000-pr1-74420c90.html","id":"ctrl:iso-31000:31000-PR1","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-31000%3A31000-PR1","sourceIds":["iso-31000"],"sourceUrl":null,"title":"31000-PR1 — Communication and consultation","type":"control","url":"/assets/agent_record-ctrl-iso-31000-31000-pr1-74420c90.05b05440a1b3648b.json"},{"attributes":{"category":"administrative","framework":"iso-31000","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-31000/","description":"Scope, context and criteria","details":{"automation":"manual","control_category":"administrative","control_id":"31000-PR2","control_type":"preventive","domains":["Risk Assessment & Management"],"framework":"iso-31000","group":"Process","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-iso-31000-31000-pr2-f0c97826.html","id":"ctrl:iso-31000:31000-PR2","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-31000%3A31000-PR2","sourceIds":["iso-31000"],"sourceUrl":null,"title":"31000-PR2 — Scope, context and criteria","type":"control","url":"/assets/agent_record-ctrl-iso-31000-31000-pr2-f0c97826.86de1fc598c79b99.json"},{"attributes":{"category":"administrative","framework":"iso-31000","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-31000/","description":"Risk assessment: risk identification","details":{"automation":"manual","control_category":"administrative","control_id":"31000-PR3","control_type":"preventive","domains":["Risk Assessment & Management"],"framework":"iso-31000","group":"Process","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-iso-31000-31000-pr3-00728ad5.html","id":"ctrl:iso-31000:31000-PR3","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-31000%3A31000-PR3","sourceIds":["iso-31000"],"sourceUrl":null,"title":"31000-PR3 — Risk assessment: risk identification","type":"control","url":"/assets/agent_record-ctrl-iso-31000-31000-pr3-00728ad5.cf51af90873509c9.json"},{"attributes":{"category":"administrative","framework":"iso-31000","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-31000/","description":"Risk assessment: risk analysis","details":{"automation":"manual","control_category":"administrative","control_id":"31000-PR4","control_type":"preventive","domains":["Risk Assessment & Management"],"framework":"iso-31000","group":"Process","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-iso-31000-31000-pr4-4b66d335.html","id":"ctrl:iso-31000:31000-PR4","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-31000%3A31000-PR4","sourceIds":["iso-31000"],"sourceUrl":null,"title":"31000-PR4 — Risk assessment: risk analysis","type":"control","url":"/assets/agent_record-ctrl-iso-31000-31000-pr4-4b66d335.5c9fda7740029675.json"},{"attributes":{"category":"administrative","framework":"iso-31000","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-31000/","description":"Risk assessment: risk evaluation","details":{"automation":"manual","control_category":"administrative","control_id":"31000-PR5","control_type":"preventive","domains":["Risk Assessment & Management"],"framework":"iso-31000","group":"Process","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-iso-31000-31000-pr5-954d6ebe.html","id":"ctrl:iso-31000:31000-PR5","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-31000%3A31000-PR5","sourceIds":["iso-31000"],"sourceUrl":null,"title":"31000-PR5 — Risk assessment: risk evaluation","type":"control","url":"/assets/agent_record-ctrl-iso-31000-31000-pr5-954d6ebe.7edd39e79ea7d234.json"},{"attributes":{"category":"administrative","framework":"iso-31000","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-31000/","description":"Risk treatment","details":{"automation":"manual","control_category":"administrative","control_id":"31000-PR6","control_type":"preventive","domains":["Risk Assessment & Management"],"framework":"iso-31000","group":"Process","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-iso-31000-31000-pr6-07fe73a7.html","id":"ctrl:iso-31000:31000-PR6","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-31000%3A31000-PR6","sourceIds":["iso-31000"],"sourceUrl":null,"title":"31000-PR6 — Risk treatment","type":"control","url":"/assets/agent_record-ctrl-iso-31000-31000-pr6-07fe73a7.5eaaf4900ee612e5.json"},{"attributes":{"category":"administrative","framework":"iso-31000","type":"detective"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-31000/","description":"Monitoring and review","details":{"automation":"manual","control_category":"administrative","control_id":"31000-PR7","control_type":"detective","domains":["Risk Assessment & Management"],"framework":"iso-31000","group":"Process","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":3,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-iso-31000-31000-pr7-97876ceb.html","id":"ctrl:iso-31000:31000-PR7","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-31000%3A31000-PR7","sourceIds":["iso-31000"],"sourceUrl":null,"title":"31000-PR7 — Monitoring and review","type":"control","url":"/assets/agent_record-ctrl-iso-31000-31000-pr7-97876ceb.14e7bbf73aba80ed.json"},{"attributes":{"category":"administrative","framework":"iso-31000","type":"detective"},"canonicalUrl":"https://controlsmap.com/frameworks/iso-31000/","description":"Recording and reporting","details":{"automation":"manual","control_category":"administrative","control_id":"31000-PR8","control_type":"detective","domains":["Risk Assessment & Management"],"framework":"iso-31000","group":"Process","key_control":false,"requirement_frequency":null,"requirement_status":null,"risk_count":2,"source_pages":null,"source_url":null},"direct":true,"htmlUrl":"/agents/records/ctrl-iso-31000-31000-pr8-fe3e8fbb.html","id":"ctrl:iso-31000:31000-PR8","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Aiso-31000%3A31000-PR8","sourceIds":["iso-31000"],"sourceUrl":null,"title":"31000-PR8 — Recording and reporting","type":"control","url":"/assets/agent_record-ctrl-iso-31000-31000-pr8-fe3e8fbb.5f05f50b6029e1d2.json"},{"attributes":{"category":"esg","domain":["AI Governance","Risk Assessment & Management"],"inherent_rating":"low","taxonomy":["iso-23894-ai-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Aai-environmental-footprint","description":"Training and large-scale inference consume disproportionate energy and generate greenhouse-gas emissions; rapid AI-hardware obsolescence produces e-waste and pressures critical-mineral supply chains, with environmental and geopolitical risk.","details":{"category":"esg","impact":"low","inherent_rating":"low","likelihood":"medium","risk_id":"ai-environmental-footprint","taxonomies":["iso-23894-ai-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-ai-environmental-footprint-c86cf6c9.html","id":"risk:ai-environmental-footprint","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Aai-environmental-footprint","sourceIds":["coso-erm","iso-31000","iso-42001","soc2"],"sourceUrl":null,"title":"Environmental footprint of AI training and infrastructure","type":"risk","url":"/assets/agent_record-risk-ai-environmental-footprint-c86cf6c9.e6981d3947bdb227.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Risk Assessment & Management"],"inherent_rating":"high","taxonomy":["nist-ai-rmf-risk","iso-23894-ai-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Aai-inaccurate-unreliable-output","description":"AI outputs contain factual errors, hallucinations, or confidently wrong predictions; inappropriate proxy metrics, overfitting/underfitting, or insufficient pre-deployment testing undermine trust in decisions made on their basis.","details":{"category":"ai_governance","impact":"high","inherent_rating":"high","likelihood":"high","risk_id":"ai-inaccurate-unreliable-output","taxonomies":["nist-ai-rmf-risk","iso-23894-ai-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-ai-inaccurate-unreliable-output-cf10c86e.html","id":"risk:ai-inaccurate-unreliable-output","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Aai-inaccurate-unreliable-output","sourceIds":["aiuc-1","eu-ai-act","iso-31000","iso-42001","nist-ai-agent-identity","nist-ai-tevv-athlon"],"sourceUrl":null,"title":"Inaccurate, unreliable or hallucinated AI outputs","type":"risk","url":"/assets/agent_record-risk-ai-inaccurate-unreliable-output-cf10c86e.e5b352e1d741db19.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Risk Assessment & Management"],"inherent_rating":"medium","taxonomy":["nist-ai-rmf-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Aai-power-concentration-societal","description":"Disproportionate access to data, compute, and AI talent creates winner-take-all dynamics foreclosing competition; proliferation of AI-generated synthetic media and automated influence operations degrades the shared epistemic environment and democratic institutions.","details":{"category":"ai_governance","impact":"medium","inherent_rating":"medium","likelihood":"medium","risk_id":"ai-power-concentration-societal","taxonomies":["nist-ai-rmf-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-ai-power-concentration-societal-473c979a.html","id":"risk:ai-power-concentration-societal","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Aai-power-concentration-societal","sourceIds":["aiuc-1","coso-erm","eu-ai-act","iso-31000","iso-42001","nist-csf-2"],"sourceUrl":null,"title":"AI power concentration and erosion of societal trust","type":"risk","url":"/assets/agent_record-risk-ai-power-concentration-societal-473c979a.8ad0af7004f690ff.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Risk Assessment & Management"],"inherent_rating":"high","taxonomy":["nist-ai-rmf-risk","iso-23894-ai-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Aai-safety-harm-to-people","description":"AI errors in safety-critical systems (autonomous vehicles, medical devices, industrial controls) cause injury or death; safety-constraint violations by agentic AI, cascading failures across coupled systems, and AI-generated misinformation/deepfakes cause harm.","details":{"category":"ai_governance","impact":"critical","inherent_rating":"high","likelihood":"low","risk_id":"ai-safety-harm-to-people","taxonomies":["nist-ai-rmf-risk","iso-23894-ai-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-ai-safety-harm-to-people-d02cb500.html","id":"risk:ai-safety-harm-to-people","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Aai-safety-harm-to-people","sourceIds":["aiuc-1","eu-ai-act","iso-31000","iso-42001","nist-ai-agent-identity","nist-ai-tevv-athlon"],"sourceUrl":null,"title":"AI safety failures causing physical or psychological harm","type":"risk","url":"/assets/agent_record-risk-ai-safety-harm-to-people-d02cb500.c92982c948595fe0.json"},{"attributes":{"category":"compliance_regulatory","domain":["Compliance, Audit & Assurance","Risk Assessment & Management"],"inherent_rating":"medium","taxonomy":["basel-operational-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Acompliance-client-suitability-fiduciary","description":"Recommending unsuitable products, failing to disclose conflicts of interest, breaching fiduciary duty, KYC failures, inadequate disclosure of fees/risks, negligent advisory activities, and product flaws causing systematic customer harm.","details":{"category":"compliance_regulatory","impact":"medium","inherent_rating":"medium","likelihood":"medium","risk_id":"compliance-client-suitability-fiduciary","taxonomies":["basel-operational-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-compliance-client-suitability-fiduciary-2212ad74.html","id":"risk:compliance-client-suitability-fiduciary","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Acompliance-client-suitability-fiduciary","sourceIds":["coso-erm","iso-31000","nist-800-53","nist-csf-2"],"sourceUrl":null,"title":"Client suitability, disclosure and fiduciary breaches","type":"risk","url":"/assets/agent_record-risk-compliance-client-suitability-fiduciary-2212ad74.f407e637f9925b75.json"},{"attributes":{"category":"compliance_regulatory","domain":["Compliance, Audit & Assurance","Risk Assessment & Management"],"inherent_rating":"medium","taxonomy":["coso-erm-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Acompliance-regulatory-policy-change","description":"Changes in law, regulation, tax policy, or government programs materially alter the entity’s cost structure, competitive dynamics, or permissible business practices, requiring costly adaptation.","details":{"category":"compliance_regulatory","impact":"medium","inherent_rating":"medium","likelihood":"medium","risk_id":"compliance-regulatory-policy-change","taxonomies":["coso-erm-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-compliance-regulatory-policy-change-9429f25b.html","id":"risk:compliance-regulatory-policy-change","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Acompliance-regulatory-policy-change","sourceIds":["cobit-2019","coso-erm","coso-ic","iso-27001","iso-31000","soc2"],"sourceUrl":null,"title":"Adverse regulatory or policy change","type":"risk","url":"/assets/agent_record-risk-compliance-regulatory-policy-change-9429f25b.c922efc13b75a562.json"},{"attributes":{"category":"cyber_security","domain":["Risk Assessment & Management","Logging, Monitoring & Detection"],"inherent_rating":"high","taxonomy":["nist-800-30-threat-source"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Acyber-adversary-threat-sources","description":"Because capable, motivated threat actors - outsiders, privileged and non-privileged insiders, organized groups, competitors, malicious partners or suppliers, and nation-states - actively target the organization's cyber resources, deliberate attacks are attempted against its systems and data, resulting in compromise, disruption, or theft when defenses are outmatched.","details":{"category":"cyber_security","impact":"high","inherent_rating":"high","likelihood":"high","risk_id":"cyber-adversary-threat-sources","taxonomies":["nist-800-30-threat-source"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-cyber-adversary-threat-sources-fa9e3003.html","id":"risk:cyber-adversary-threat-sources","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Acyber-adversary-threat-sources","sourceIds":["aiuc-1","cobit-2019","coso-ic","gdpr","iso-27001","iso-31000","nist-800-53","nist-csf-2","nydfs-500","soc1","soc2","sox"],"sourceUrl":null,"title":"Attacks by capable, motivated threat actors","type":"risk","url":"/assets/agent_record-risk-cyber-adversary-threat-sources-fa9e3003.8ace32770a775a42.json"},{"attributes":{"category":"compliance_regulatory","domain":["Compliance, Audit & Assurance","Risk Assessment & Management","Governance, Policy & Oversight"],"inherent_rating":"high","taxonomy":["enterprise-risk","basel-operational-risk","coso-erm-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Afin-crime-aml-sanctions","description":"Failure to prevent money laundering or terrorist financing, file SARs/CTRs, perform adequate KYC/beneficial-ownership due diligence, screen for PEPs, or avoid processing transactions for OFAC-sanctioned parties; BSA/AML program deficiencies.","details":{"category":"compliance_regulatory","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"fin-crime-aml-sanctions","taxonomies":["enterprise-risk","basel-operational-risk","coso-erm-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-fin-crime-aml-sanctions-80b15201.html","id":"risk:fin-crime-aml-sanctions","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Afin-crime-aml-sanctions","sourceIds":["cobit-2019","coso-erm","coso-ic","iso-31000","nist-csf-2","soc2"],"sourceUrl":null,"title":"Money laundering, sanctions and financial-crime program failures","type":"risk","url":"/assets/agent_record-risk-fin-crime-aml-sanctions-80b15201.3441cdfac714d353.json"},{"attributes":{"category":"financial","domain":["Risk Assessment & Management"],"inherent_rating":"high","taxonomy":["enterprise-risk","coso-erm-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Afinancial-credit-market-risk","description":"Counterparty/customer default exceeding collateral, receivables concentration in deteriorating credits, and unhedged exposure to interest-rate, foreign-exchange, commodity, or equity movements causing material P&L or cash-flow volatility.","details":{"category":"financial","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"financial-credit-market-risk","taxonomies":["enterprise-risk","coso-erm-risk"],"treatment":"transfer"},"direct":false,"htmlUrl":"/agents/records/risk-financial-credit-market-risk-b9cbc5a3.html","id":"risk:financial-credit-market-risk","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Afinancial-credit-market-risk","sourceIds":["iso-27001","iso-31000","nist-csf-2"],"sourceUrl":null,"title":"Credit and market (rate/FX) risk","type":"risk","url":"/assets/agent_record-risk-financial-credit-market-risk-b9cbc5a3.c3ceceb3662b9c9e.json"},{"attributes":{"category":"financial","domain":["Risk Assessment & Management"],"inherent_rating":"high","taxonomy":["enterprise-risk","coso-erm-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Afinancial-liquidity-capital","description":"Cash-flow shortfall from working-capital deterioration, covenant breaches accelerating debt, loss of revolving credit, or capital-market disruption; debt maturity walls and downgrades limiting refinancing at acceptable terms; insufficient capital to absorb losses.","details":{"category":"financial","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"financial-liquidity-capital","taxonomies":["enterprise-risk","coso-erm-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-financial-liquidity-capital-e0ac2d24.html","id":"risk:financial-liquidity-capital","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Afinancial-liquidity-capital","sourceIds":["coso-erm","coso-ic","iso-31000","nist-800-53","nist-csf-2","nydfs-500","soc2","sox"],"sourceUrl":null,"title":"Liquidity, capital-structure and refinancing risk","type":"risk","url":"/assets/agent_record-risk-financial-liquidity-capital-e0ac2d24.0f938fc816181917.json"},{"attributes":{"category":"operational","domain":["Risk Assessment & Management","Governance, Policy & Oversight"],"inherent_rating":"medium","taxonomy":["coso-erm-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Agov-project-change-management","description":"Large programs — ERP implementations, digital transformations, or major capital projects — fail to deliver expected benefits on time and within budget due to poor governance, scope creep, or capability gaps.","details":{"category":"operational","impact":"medium","inherent_rating":"medium","likelihood":"medium","risk_id":"gov-project-change-management","taxonomies":["coso-erm-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-gov-project-change-management-335e75ed.html","id":"risk:gov-project-change-management","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Agov-project-change-management","sourceIds":["cobit-2019","iso-27001","iso-31000","nist-csf-2"],"sourceUrl":null,"title":"Major project / program delivery failure","type":"risk","url":"/assets/agent_record-risk-gov-project-change-management-335e75ed.8970e3bf83bc1fe0.json"},{"attributes":{"category":"operational","domain":["Risk Assessment & Management"],"inherent_rating":"medium","taxonomy":["basel-operational-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Aops-counterparty-settlement-disputes","description":"Counterparty default on OTC derivatives, settlement disputes with brokers/custodians, failure of a central counterparty, netting/close-out disputes, and margin-call miscalculations cause direct losses.","details":{"category":"operational","impact":"medium","inherent_rating":"medium","likelihood":"low","risk_id":"ops-counterparty-settlement-disputes","taxonomies":["basel-operational-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-ops-counterparty-settlement-disputes-eaf4600f.html","id":"risk:ops-counterparty-settlement-disputes","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Aops-counterparty-settlement-disputes","sourceIds":["coso-erm","iso-31000","nist-800-53","nist-csf-2","soc2"],"sourceUrl":null,"title":"Trade-counterparty performance and settlement disputes","type":"risk","url":"/assets/agent_record-risk-ops-counterparty-settlement-disputes-eaf4600f.d87381a70e53a658.json"},{"attributes":{"category":"operational","domain":["Risk Assessment & Management","Access Control & Identity Management"],"inherent_rating":"medium","taxonomy":["basel-operational-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Aops-documentation-account-management","description":"Missing signed agreements, incomplete legal/ISDA documentation, unretained KYC/AML records, misfiled client files, unauthorized access to client accounts, and negligent loss of client assets held in custody.","details":{"category":"operational","impact":"medium","inherent_rating":"medium","likelihood":"medium","risk_id":"ops-documentation-account-management","taxonomies":["basel-operational-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-ops-documentation-account-management-d25eb1fe.html","id":"risk:ops-documentation-account-management","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Aops-documentation-account-management","sourceIds":["aiuc-1","gdpr","hipaa","iso-27001","iso-31000","nist-800-53","nist-ai-agent-identity","nist-csf-2"],"sourceUrl":null,"title":"Client intake, documentation and account-management failures","type":"risk","url":"/assets/agent_record-risk-ops-documentation-account-management-d25eb1fe.77187893f2bb342b.json"},{"attributes":{"category":"operational","domain":["Risk Assessment & Management"],"inherent_rating":"high","taxonomy":["coso-erm-risk","enterprise-risk","basel-operational-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Aops-product-service-quality","description":"Outputs fail to meet specifications, customer requirements, or regulatory standards, leading to recalls, warranty claims, customer attrition, and reputational harm; product-safety incidents generate scrutiny and brand-equity erosion.","details":{"category":"operational","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"ops-product-service-quality","taxonomies":["coso-erm-risk","enterprise-risk","basel-operational-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-ops-product-service-quality-2066b257.html","id":"risk:ops-product-service-quality","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Aops-product-service-quality","sourceIds":["coso-erm","iso-31000","nist-csf-2","soc2"],"sourceUrl":null,"title":"Product and service quality failure","type":"risk","url":"/assets/agent_record-risk-ops-product-service-quality-2066b257.2c15027d0b162c78.json"},{"attributes":{"category":"reputational","domain":["Governance, Policy & Oversight","Risk Assessment & Management"],"inherent_rating":"medium","taxonomy":["coso-erm-risk","enterprise-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Areputational-stakeholder-trust","description":"Gradual loss of trust and social license among customers, employees, investors, regulators, and communities — from perceived values misalignment, poor ESG/governance conduct, or repeated service failures — weakening stakeholder relationships and long-term enterprise value even absent a single acute crisis.","details":{"category":"reputational","impact":"medium","inherent_rating":"medium","likelihood":"medium","risk_id":"reputational-stakeholder-trust","taxonomies":["coso-erm-risk","enterprise-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-reputational-stakeholder-trust-23d21e70.html","id":"risk:reputational-stakeholder-trust","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Areputational-stakeholder-trust","sourceIds":["cobit-2019","coso-erm","coso-ic","gdpr","iia-pos-2026-erm","iia-pos-2026-three-lines","iso-31000","nist-800-53","nist-csf-2","soc2","sox"],"sourceUrl":null,"title":"Stakeholder trust and social-license erosion","type":"risk","url":"/assets/agent_record-risk-reputational-stakeholder-trust-23d21e70.cc84ea3ea3c8507a.json"},{"attributes":{"category":"operational","domain":["Risk Assessment & Management","Governance, Policy & Oversight"],"inherent_rating":"high","taxonomy":["coso-erm-risk","enterprise-risk","nist-privacy-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Arisk-assessment-inadequate","description":"No systematic process to identify, analyse, evaluate, and treat risk — including missing fraud-risk assessment and no ongoing risk monitoring — leaving material exposures unidentified and untreated before they materialise.","details":{"category":"operational","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"risk-assessment-inadequate","taxonomies":["coso-erm-risk","enterprise-risk","nist-privacy-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-risk-assessment-inadequate-328128b5.html","id":"risk:risk-assessment-inadequate","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Arisk-assessment-inadequate","sourceIds":["cobit-2019","coso-erm","coso-ic","eu-ai-act","iso-31000","nist-800-53","nist-csf-2","nydfs-500","soc2","sox"],"sourceUrl":null,"title":"Inadequate or absent risk assessment process","type":"risk","url":"/assets/agent_record-risk-risk-assessment-inadequate-328128b5.d129815d96ef1693.json"},{"attributes":{"category":"strategic","domain":["Risk Assessment & Management"],"inherent_rating":"high","taxonomy":["enterprise-risk","coso-erm-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Astrategic-concentration","description":"Revenue or gross profit concentrated in a single product line, customer, channel, or geography; loss of one major customer or an adverse regulatory change to a dominant product creates existential revenue risk.","details":{"category":"strategic","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"strategic-concentration","taxonomies":["enterprise-risk","coso-erm-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-strategic-concentration-816dfff6.html","id":"risk:strategic-concentration","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Astrategic-concentration","sourceIds":["coso-erm","iso-31000","nist-800-53","nist-csf-2"],"sourceUrl":null,"title":"Product, customer or market concentration","type":"risk","url":"/assets/agent_record-risk-strategic-concentration-816dfff6.b839ccb8f7d1c607.json"},{"attributes":{"category":"strategic","domain":["Risk Assessment & Management","Governance, Policy & Oversight"],"inherent_rating":"high","taxonomy":["enterprise-risk","coso-erm-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Astrategic-disruption-substitution","description":"A new entrant with a superior model, lower cost, or breakthrough technology captures share faster than the company can respond; industry/technology/customer shifts render the existing business model obsolete.","details":{"category":"strategic","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"strategic-disruption-substitution","taxonomies":["enterprise-risk","coso-erm-risk"],"treatment":"mitigate"},"direct":false,"htmlUrl":"/agents/records/risk-strategic-disruption-substitution-516d480f.html","id":"risk:strategic-disruption-substitution","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Astrategic-disruption-substitution","sourceIds":["cobit-2019","coso-erm","coso-ic","iso-31000","soc2"],"sourceUrl":null,"title":"Competitive disruption and business-model obsolescence","type":"risk","url":"/assets/agent_record-risk-strategic-disruption-substitution-516d480f.bfc3226901e8482b.json"}],"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:00788c1850c88ebc7d71da3d304bd51223e6e1b30b0d2aa0e46ed6c95111935f","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-31000-31000-fw3-21cc689c.json","sourceId":"ctrl:iso-31000:31000-FW3","targetDetailPath":"/data/v1/records/std-iso-31000-ead920a9.json","targetId":"std:iso-31000","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:053894cbc795235041b15d1e803cfd21ad0a4f3e12ea6f574ebf2b37bf03e502","properties":{"rationale":"AI-Act Art 9 lifecycle risk processes in the framework establish the governance under which high-risk-AI safety risks are identified and mitigated.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-01-13d56297.json","sourceId":"uc:UC-RISK-01","targetDetailPath":"/data/v1/records/risk-ai-safety-harm-to-people-d02cb500.json","targetId":"risk:ai-safety-harm-to-people","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:0810351e17f27419b026c3722645fb72847323674b505082c6a8da3346e8d96a","properties":{"control_id":"31000-PR2","coverage":"full","delta":null,"framework":"iso-31000","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2018"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-03-31e0ad29.json","sourceId":"uc:UC-RISK-03","targetDetailPath":"/data/v1/records/ctrl-iso-31000-31000-pr2-f0c97826.json","targetId":"ctrl:iso-31000:31000-PR2","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:0a0070742580f23a1c2ff349153e822dde9f43340c2779ce29b38fcdac6e6659","properties":{"rationale":"Evaluating and prioritising analyzed risks against criteria to decide treatment is a core process step countering an assessment that never reaches decisions.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-08-5f27bebc.json","sourceId":"uc:UC-RISK-08","targetDetailPath":"/data/v1/records/risk-risk-assessment-inadequate-328128b5.json","targetId":"risk:risk-assessment-inadequate","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:0da3bc474260b75a3f2a77a1c5c58d36b4bb88caca3bdc88209c7154ad73499d","properties":{"control_id":"31000-P1","coverage":"full","delta":null,"framework":"iso-31000","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2018"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-02-0f8519bb.json","sourceId":"uc:UC-RISK-02","targetDetailPath":"/data/v1/records/ctrl-iso-31000-31000-p1-ee160f4d.json","targetId":"ctrl:iso-31000:31000-P1","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:0e6c7a97edc4f55665d7179950b1acf998d3c3cadebf7710e81e03bcdd44c52e","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-31000-31000-p3-fda14ae5.json","sourceId":"ctrl:iso-31000:31000-P3","targetDetailPath":"/data/v1/records/std-iso-31000-ead920a9.json","targetId":"std:iso-31000","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:1611bdb7b5a04c01c27e2eba27dc71de06acba7c8b3071d40a3ea0340ca56850","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-31000-31000-p4-400c4417.json","sourceId":"ctrl:iso-31000:31000-P4","targetDetailPath":"/data/v1/records/std-iso-31000-ead920a9.json","targetId":"std:iso-31000","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:1edb80670c202f554622f58d46a3add49b2a5cbd560424619524914869bc2428","properties":{"control_id":"31000-FW6","coverage":"full","delta":null,"framework":"iso-31000","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2018"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-15-e01fb134.json","sourceId":"uc:UC-RISK-15","targetDetailPath":"/data/v1/records/ctrl-iso-31000-31000-fw6-caaa68bb.json","targetId":"ctrl:iso-31000:31000-FW6","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2754750eaaa885c1da8468ff91127cbfa89ad977327a827659f27a030198744b","properties":{"rationale":"A maintained risk register with status and portfolio reporting is the ongoing risk monitoring the risk describes as missing.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-10-6d44f690.json","sourceId":"uc:UC-RISK-10","targetDetailPath":"/data/v1/records/risk-risk-assessment-inadequate-328128b5.json","targetId":"risk:risk-assessment-inadequate","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:28645f2a325f79d63c399b18c3c84e6724856ee2eb2dbd3307cbd7cf87505038","properties":{"control_id":"31000-FW2","coverage":"full","delta":null,"framework":"iso-31000","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2018"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-02-0f8519bb.json","sourceId":"uc:UC-RISK-02","targetDetailPath":"/data/v1/records/ctrl-iso-31000-31000-fw2-002ea142.json","targetId":"ctrl:iso-31000:31000-FW2","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:29dedf612f5974c39011fefd61d892f6886d62b0af182e6092ad1a2a47a89ede","properties":{"rationale":"","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-08-5f27bebc.json","sourceId":"uc:UC-RISK-08","targetDetailPath":"/data/v1/records/risk-ops-counterparty-settlement-disputes-eaf4600f.json","targetId":"risk:ops-counterparty-settlement-disputes","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2a2f9da8dcc98281a863775b64d954f01de7157bd6f38eae1e01d92f66a77f8f","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-31000-31000-p8-251dfb3d.json","sourceId":"ctrl:iso-31000:31000-P8","targetDetailPath":"/data/v1/records/std-iso-31000-ead920a9.json","targetId":"std:iso-31000","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2eb3bf860527ae764ceb223797b7c644151e7196d1c96259d91b201567ae61c5","properties":{"rationale":"Monitoring/reviewing the framework's own performance detects process decay, but is meta-monitoring of the program, not the operative assessment steps; ongoing risk monitoring itself sits in the register/reassessment controls.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-13-75b9f6c7.json","sourceId":"uc:UC-RISK-13","targetDetailPath":"/data/v1/records/risk-risk-assessment-inadequate-328128b5.json","targetId":"risk:risk-assessment-inadequate","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:308d19dd03155f6dc9ea3c87320bb230cc6e778377b2a61fad9b279095cc4a2e","properties":{"control_id":"31000-PR8","coverage":"full","delta":null,"framework":"iso-31000","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2018"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-10-6d44f690.json","sourceId":"uc:UC-RISK-10","targetDetailPath":"/data/v1/records/ctrl-iso-31000-31000-pr8-fe3e8fbb.json","targetId":"ctrl:iso-31000:31000-PR8","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:38356248cfe15a2821b2a07828be9a210480af0f7a1069af8fbf8fa90248e6c4","properties":{"rationale":"","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-07-b86de728.json","sourceId":"uc:UC-RISK-07","targetDetailPath":"/data/v1/records/risk-fin-crime-aml-sanctions-80b15201.json","targetId":"risk:fin-crime-aml-sanctions","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:3b0670471e888d313b22d556ad8f7e5f1a50dc984be7eaaae37ffe3fd4b2eee4","properties":{"control_id":"31000-P4","coverage":"full","delta":null,"framework":"iso-31000","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2018"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-05-e2fc10a6.json","sourceId":"uc:UC-RISK-05","targetDetailPath":"/data/v1/records/ctrl-iso-31000-31000-p4-400c4417.json","targetId":"ctrl:iso-31000:31000-P4","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:3c7112f7f5d9f6e6de0b21c723abc7ee1c5f42434ddb78e7fcd92ba9524151a5","properties":{"rationale":"","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-03-31e0ad29.json","sourceId":"uc:UC-RISK-03","targetDetailPath":"/data/v1/records/risk-compliance-client-suitability-fiduciary-2212ad74.json","targetId":"risk:compliance-client-suitability-fiduciary","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:3f60048df0bf434b9944e6ff98f989686c205eba83053ad190121861f011f222","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-31000-31000-pr8-fe3e8fbb.json","sourceId":"ctrl:iso-31000:31000-PR8","targetDetailPath":"/data/v1/records/std-iso-31000-ead920a9.json","targetId":"std:iso-31000","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:419f41cba15666eaa8e6b4f757bcc3310359b6403fd9fe06262513b22dba479b","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-31000-31000-pr3-00728ad5.json","sourceId":"ctrl:iso-31000:31000-PR3","targetDetailPath":"/data/v1/records/std-iso-31000-ead920a9.json","targetId":"std:iso-31000","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:42a4d9394bb6b7ca626460c5d5e8995f3cbb8b1ac9f75e91b807e40976ac6d0a","properties":{"rationale":"","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-09-06ffdff1.json","sourceId":"uc:UC-RISK-09","targetDetailPath":"/data/v1/records/risk-financial-liquidity-capital-e0ac2d24.json","targetId":"risk:financial-liquidity-capital","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:442b214a3a15689767f0084c623fab429ea634cf1bc61a3b1a28a625c312b729","properties":{"control_id":"31000-P5","coverage":"full","delta":null,"framework":"iso-31000","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2018"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-11-3f5d23ea.json","sourceId":"uc:UC-RISK-11","targetDetailPath":"/data/v1/records/ctrl-iso-31000-31000-p5-f7cd76e5.json","targetId":"ctrl:iso-31000:31000-P5","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:445aa73f51cb83f72a3bb8454e3b5138eee58b093cd50426398ee1c766ef0904","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-31000-31000-p2-48e44995.json","sourceId":"ctrl:iso-31000:31000-P2","targetDetailPath":"/data/v1/records/std-iso-31000-ead920a9.json","targetId":"std:iso-31000","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:491879c8cb8b14f518463077e14630f7a4f1a7c89a4ee06d83c3673454f3a430","properties":{"rationale":"Defining risk appetite, tolerance and structured assessment criteria supplies the yardsticks without which risks cannot be consistently calculated, categorised or prioritised.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-03-31e0ad29.json","sourceId":"uc:UC-RISK-03","targetDetailPath":"/data/v1/records/risk-risk-assessment-inadequate-328128b5.json","targetId":"risk:risk-assessment-inadequate","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:51bad5a1784a763c1e268a12319e2469c028207190509ebf9976c2c5ac8117f9","properties":{"rationale":"","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-09-06ffdff1.json","sourceId":"uc:UC-RISK-09","targetDetailPath":"/data/v1/records/risk-compliance-client-suitability-fiduciary-2212ad74.json","targetId":"risk:compliance-client-suitability-fiduciary","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:52fddd6bb4310a990e0736070615bf075c1bea5afacc03c4d9e545908a07e89a","properties":{"rationale":"GV.RM-03 member folds cyber risk into ERM, giving threats enterprise governance and resourcing, an enabler rather than the operative defense against attackers.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-02-0f8519bb.json","sourceId":"uc:UC-RISK-02","targetDetailPath":"/data/v1/records/risk-cyber-adversary-threat-sources-fa9e3003.json","targetId":"risk:cyber-adversary-threat-sources","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:534c8d98a58d9a5e55336b56dea75b05990b462c31487f1ed2242dcc39e26d21","properties":{"rationale":"Systematic risk identification and likelihood/impact analysis with consistent severity scales is the analytic core of the risk-assessment process.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-07-b86de728.json","sourceId":"uc:UC-RISK-07","targetDetailPath":"/data/v1/records/risk-risk-assessment-inadequate-328128b5.json","targetId":"risk:risk-assessment-inadequate","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:562ed1f4d761bf88a5acd404fdeb05426f0e1d6b92c82f1e669169ae5d60bb92","properties":{"rationale":"","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-15-e01fb134.json","sourceId":"uc:UC-RISK-15","targetDetailPath":"/data/v1/records/risk-ai-power-concentration-societal-473c979a.json","targetId":"risk:ai-power-concentration-societal","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:705c294872ff4474bf856a99081a5a962c9413596ee5b94fd016776be8563910","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-31000-31000-fw5-2768e6fc.json","sourceId":"ctrl:iso-31000:31000-FW5","targetDetailPath":"/data/v1/records/std-iso-31000-ead920a9.json","targetId":"std:iso-31000","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:72ffde935f696b703eea046c531a92e285ac71f3eaf3d977058b2d3f607b5a63","properties":{"control_id":"31000-P8","coverage":"full","delta":null,"framework":"iso-31000","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2018"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-15-e01fb134.json","sourceId":"uc:UC-RISK-15","targetDetailPath":"/data/v1/records/ctrl-iso-31000-31000-p8-251dfb3d.json","targetId":"ctrl:iso-31000:31000-P8","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:75ff039d90bc93d5f1d4fd7660b32ce5da306909228a1c6223e66af0e9199d69","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-31000-31000-pr6-07fe73a7.json","sourceId":"ctrl:iso-31000:31000-PR6","targetDetailPath":"/data/v1/records/std-iso-31000-ead920a9.json","targetId":"std:iso-31000","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7877f755e6a303523d611a8c97fe31126acb9a876f035e0a367a7ad44141b750","properties":{"rationale":"","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-05-e2fc10a6.json","sourceId":"uc:UC-RISK-05","targetDetailPath":"/data/v1/records/risk-financial-credit-market-risk-b9cbc5a3.json","targetId":"risk:financial-credit-market-risk","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7955b1b9fa047a0492a763f43d53011ae30ae41757addefe26ff91d2b795c4c8","properties":{"rationale":"","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-07-b86de728.json","sourceId":"uc:UC-RISK-07","targetDetailPath":"/data/v1/records/risk-strategic-concentration-816dfff6.json","targetId":"risk:strategic-concentration","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7b14cc3ff44ca206173550e43410b9e421d33922cc54ffd80a58d271b30580ab","properties":{"control_id":"31000-PR7","coverage":"full","delta":null,"framework":"iso-31000","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2018"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-13-75b9f6c7.json","sourceId":"uc:UC-RISK-13","targetDetailPath":"/data/v1/records/ctrl-iso-31000-31000-pr7-97876ceb.json","targetId":"ctrl:iso-31000:31000-PR7","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:81f572e3716dc1d9387fe26a005ebb5f7cd8d03bde2fe7f42aa4200c98b25fb3","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-31000-31000-fw6-caaa68bb.json","sourceId":"ctrl:iso-31000:31000-FW6","targetDetailPath":"/data/v1/records/std-iso-31000-ead920a9.json","targetId":"std:iso-31000","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:82261d4bfcb0c34be642562f348896f110e7bb4960a4f65ec5685d4efccea722","properties":{"control_id":"31000-FW1","coverage":"full","delta":null,"framework":"iso-31000","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2018"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-01-13d56297.json","sourceId":"uc:UC-RISK-01","targetDetailPath":"/data/v1/records/ctrl-iso-31000-31000-fw1-112c0ed5.json","targetId":"ctrl:iso-31000:31000-FW1","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:88db5bf5f404b4c0944be6f79b27363f6d2bc42c4eeae4b133f6576d29894ad4","properties":{"control_id":"31000-FW3","coverage":"full","delta":null,"framework":"iso-31000","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2018"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-01-13d56297.json","sourceId":"uc:UC-RISK-01","targetDetailPath":"/data/v1/records/ctrl-iso-31000-31000-fw3-21cc689c.json","targetId":"ctrl:iso-31000:31000-FW3","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:8ad5b17690f78367d133fed23b478f209f95beb04a7383de31d7fd684e4f79b4","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-31000-31000-pr4-4b66d335.json","sourceId":"ctrl:iso-31000:31000-PR4","targetDetailPath":"/data/v1/records/std-iso-31000-ead920a9.json","targetId":"std:iso-31000","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:90878588df00f7d57db2d579ea31b5def525f8d552d2053df6dcd6a98660c2f3","properties":{"rationale":"Control explicitly assesses regulatory changes for risk impact; early detection of adverse law/policy change enables timely, less costly adaptation.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-11-3f5d23ea.json","sourceId":"uc:UC-RISK-11","targetDetailPath":"/data/v1/records/risk-compliance-regulatory-policy-change-9429f25b.json","targetId":"risk:compliance-regulatory-policy-change","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:96c0b877a6f77c769fe02d2fd36d3fd61537aab48fd6b10983d7c6be89f6a09d","properties":{"rationale":"","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-02-0f8519bb.json","sourceId":"uc:UC-RISK-02","targetDetailPath":"/data/v1/records/risk-financial-credit-market-risk-b9cbc5a3.json","targetId":"risk:financial-credit-market-risk","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9889444ed3d4f2f27421e35971287d0c24f217cb6401b87df88946c8f6816f3e","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-31000-31000-pr2-f0c97826.json","sourceId":"ctrl:iso-31000:31000-PR2","targetDetailPath":"/data/v1/records/std-iso-31000-ead920a9.json","targetId":"std:iso-31000","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9a8319c2f1db21fe6e3398bafe3fbe34599762ebec37bf4b2c6bce0145c27c85","properties":{"control_id":"31000-P2","coverage":"full","delta":null,"framework":"iso-31000","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2018"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-03-31e0ad29.json","sourceId":"uc:UC-RISK-03","targetDetailPath":"/data/v1/records/ctrl-iso-31000-31000-p2-48e44995.json","targetId":"ctrl:iso-31000:31000-P2","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9b9ac927c9a930f587f4139fc1b2a5ff1a41ca067a428730d2d339bbcd6f30ce","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-31000-31000-fw2-002ea142.json","sourceId":"ctrl:iso-31000:31000-FW2","targetDetailPath":"/data/v1/records/std-iso-31000-ead920a9.json","targetId":"std:iso-31000","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9e1dd44af111fe5210a4caf943b2f11f00f4a341bdf3149dbca73e398823c219","properties":{"rationale":"Continually improving the framework from lessons sustains the process's suitability over time, but acts on the program rather than operating the assessment steps; a second-order contributor to sustained adequacy, not operative defense.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-15-e01fb134.json","sourceId":"uc:UC-RISK-15","targetDetailPath":"/data/v1/records/risk-risk-assessment-inadequate-328128b5.json","targetId":"risk:risk-assessment-inadequate","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9f3f3a31fa68876023a7f851575d5cb505d144a0e01b590f0382f6be9f257362","properties":{"control_id":"31000-PR5","coverage":"full","delta":null,"framework":"iso-31000","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2018"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-08-5f27bebc.json","sourceId":"uc:UC-RISK-08","targetDetailPath":"/data/v1/records/ctrl-iso-31000-31000-pr5-954d6ebe.json","targetId":"ctrl:iso-31000:31000-PR5","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a1ade2ecfeaafa29fe537b9bfd5c374696c15575d8518e586aa8e17aaf1a0891","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-31000-31000-pr5-954d6ebe.json","sourceId":"ctrl:iso-31000:31000-PR5","targetDetailPath":"/data/v1/records/std-iso-31000-ead920a9.json","targetId":"std:iso-31000","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a21077e4bec07cc3fa7adc371c05d84839954ae452369ee04848bc2a464af6ed","properties":{"rationale":"Selecting, planning and tracking risk treatments to residual-risk re-evaluation is the treat stage; operating it stops exposures being left untreated.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-09-06ffdff1.json","sourceId":"uc:UC-RISK-09","targetDetailPath":"/data/v1/records/risk-risk-assessment-inadequate-328128b5.json","targetId":"risk:risk-assessment-inadequate","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a35db22b4d1d55cea5944fa95aba31ca2a0498e4556a0f1d7692a23ca538a7bc","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-31000-31000-p1-ee160f4d.json","sourceId":"ctrl:iso-31000:31000-P1","targetDetailPath":"/data/v1/records/std-iso-31000-ead920a9.json","targetId":"std:iso-31000","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:aab51f333f0d48fbd3cc93614b6d145bc8f74f784eea9adf24bc544184813601","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-31000-31000-fw4-b350dbe6.json","sourceId":"ctrl:iso-31000:31000-FW4","targetDetailPath":"/data/v1/records/std-iso-31000-ead920a9.json","targetId":"std:iso-31000","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b4424862ed92282ece0b8ae99b66cb94fb06b9093704e70a4c18fb55df20e7bf","properties":{"control_id":"31000-P3","coverage":"full","delta":null,"framework":"iso-31000","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2018"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-01-13d56297.json","sourceId":"uc:UC-RISK-01","targetDetailPath":"/data/v1/records/ctrl-iso-31000-31000-p3-fda14ae5.json","targetId":"ctrl:iso-31000:31000-P3","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b4ac550cf35f67c88ade6b84d6b20584d58509b05a083d01559a72bb25606849","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-31000-31000-p5-f7cd76e5.json","sourceId":"ctrl:iso-31000:31000-P5","targetDetailPath":"/data/v1/records/std-iso-31000-ead920a9.json","targetId":"std:iso-31000","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b9ee85d756575a42f52b717386da075f3819594150c1259ce288f7cd4c991789","properties":{"rationale":"A.5.8 member requires infosec risk addressed in project management from initiation to delivery, contributing to project governance and fewer delivery surprises.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-02-0f8519bb.json","sourceId":"uc:UC-RISK-02","targetDetailPath":"/data/v1/records/risk-gov-project-change-management-335e75ed.json","targetId":"risk:gov-project-change-management","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:ba7b966f8a1ebe9cfbf3fc12b20338388d851c39aa09f232ead434f202281d98","properties":{"control_id":"31000-FW4","coverage":"full","delta":null,"framework":"iso-31000","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2018"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-01-13d56297.json","sourceId":"uc:UC-RISK-01","targetDetailPath":"/data/v1/records/ctrl-iso-31000-31000-fw4-b350dbe6.json","targetId":"ctrl:iso-31000:31000-FW4","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:bb7bd3f7c6f1bc484ed54b1f6b7adccec6955cf8e0b697659c44e74b7924f703","properties":{"control_id":"31000-PR3","coverage":"full","delta":null,"framework":"iso-31000","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2018"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-07-b86de728.json","sourceId":"uc:UC-RISK-07","targetDetailPath":"/data/v1/records/ctrl-iso-31000-31000-pr3-00728ad5.json","targetId":"ctrl:iso-31000:31000-PR3","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:bc705a063cbaf0630b6ec6695e7e290d46b65c7cf4a5be3c50e44f5ee369af01","properties":{"rationale":"","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-05-e2fc10a6.json","sourceId":"uc:UC-RISK-05","targetDetailPath":"/data/v1/records/risk-ops-documentation-account-management-d25eb1fe.json","targetId":"risk:ops-documentation-account-management","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:c0bae0dccc8f1428dc38fe0134176e0295206acb8b916d735b708929fd762606","properties":{"rationale":"","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-15-e01fb134.json","sourceId":"uc:UC-RISK-15","targetDetailPath":"/data/v1/records/risk-ops-product-service-quality-2066b257.json","targetId":"risk:ops-product-service-quality","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:c1609b63dea13aba9293025624efa33d2d4a0f025a4c4c95eb932e55308c1c8d","properties":{"control_id":"31000-P6","coverage":"full","delta":null,"framework":"iso-31000","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2018"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-07-b86de728.json","sourceId":"uc:UC-RISK-07","targetDetailPath":"/data/v1/records/ctrl-iso-31000-31000-p6-522c7c23.json","targetId":"ctrl:iso-31000:31000-P6","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:c16b8246d1f709293b13d30603391461f1760de1089bd4a02a84b12c65f643f0","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-31000-31000-pr7-97876ceb.json","sourceId":"ctrl:iso-31000:31000-PR7","targetDetailPath":"/data/v1/records/std-iso-31000-ead920a9.json","targetId":"std:iso-31000","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:ca75ce1842ad6dbf57f03c7a75c4dfc9f26e0776873f0c10b85ae02963722f3b","properties":{"rationale":"Establishing/maintaining an ERM framework is the direct antidote to having no systematic process to identify, analyse, evaluate and treat risk.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-01-13d56297.json","sourceId":"uc:UC-RISK-01","targetDetailPath":"/data/v1/records/risk-risk-assessment-inadequate-328128b5.json","targetId":"risk:risk-assessment-inadequate","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d5c3cea818007d07c47e58106742347fda49b240d841b8378437151e81b51f55","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-31000-31000-fw1-112c0ed5.json","sourceId":"ctrl:iso-31000:31000-FW1","targetDetailPath":"/data/v1/records/std-iso-31000-ead920a9.json","targetId":"std:iso-31000","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d655ca9213949ed87040d030a989bffdcd3db124beecc4962a5d2ee474a2a159","properties":{"rationale":"Structured, inclusive stakeholder consultation on risk, considering human/cultural factors, sustains stakeholder relationships and social license, a contributor to trust.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-05-e2fc10a6.json","sourceId":"uc:UC-RISK-05","targetDetailPath":"/data/v1/records/risk-reputational-stakeholder-trust-23d21e70.json","targetId":"risk:reputational-stakeholder-trust","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d6ed284de56ace12f7b7eefc3703a0c75858bf2f8b0f57dd78dc4d8bd39e7ed9","properties":{"rationale":"","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-13-75b9f6c7.json","sourceId":"uc:UC-RISK-13","targetDetailPath":"/data/v1/records/risk-ai-environmental-footprint-c86cf6c9.json","targetId":"risk:ai-environmental-footprint","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:dfa22d16bf53e144cc08d681665a0a86c329058bebd0c8f885a8ad935b03279c","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-31000-31000-pr1-74420c90.json","sourceId":"ctrl:iso-31000:31000-PR1","targetDetailPath":"/data/v1/records/std-iso-31000-ead920a9.json","targetId":"std:iso-31000","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e1dd84eb911b18a4df48a7c8e04205ae4f74ef3be313e542bd91cd1422a54004","properties":{"control_id":"31000-FW5","coverage":"full","delta":null,"framework":"iso-31000","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2018"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-13-75b9f6c7.json","sourceId":"uc:UC-RISK-13","targetDetailPath":"/data/v1/records/ctrl-iso-31000-31000-fw5-2768e6fc.json","targetId":"ctrl:iso-31000:31000-FW5","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e259e3c412f6d736297d4fbc9d7faa2b7da1978effb0d21d0b7434df82247219","properties":{"control_id":"31000-PR4","coverage":"full","delta":null,"framework":"iso-31000","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2018"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-07-b86de728.json","sourceId":"uc:UC-RISK-07","targetDetailPath":"/data/v1/records/ctrl-iso-31000-31000-pr4-4b66d335.json","targetId":"ctrl:iso-31000:31000-PR4","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e2a77da7eb2d53881cc6b7b39751ab03bb756c18c15c7048af081bf1b6943819","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-31000-31000-p7-3d100675.json","sourceId":"ctrl:iso-31000:31000-P7","targetDetailPath":"/data/v1/records/std-iso-31000-ead920a9.json","targetId":"std:iso-31000","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e4614d739e72ff5fabf08afc4dc713798860b3f812dac531578255ac8836640a","properties":{"rationale":"","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-03-31e0ad29.json","sourceId":"uc:UC-RISK-03","targetDetailPath":"/data/v1/records/risk-strategic-concentration-816dfff6.json","targetId":"risk:strategic-concentration","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e765cd097bbd92adeec23f4e2988d0b58ae3814132d8fd4cd82fba1d62079072","properties":{"rationale":"Control assesses new business models and emerging risks; early detection of disruptive industry/technology shifts enables response before the model is obsoleted.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-11-3f5d23ea.json","sourceId":"uc:UC-RISK-11","targetDetailPath":"/data/v1/records/risk-strategic-disruption-substitution-516d480f.json","targetId":"risk:strategic-disruption-substitution","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e95faa215555a9f1318fcd4140e43fb579bfe6c1e8d0768405c86df290003ac9","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-iso-31000-31000-p6-522c7c23.json","sourceId":"ctrl:iso-31000:31000-P6","targetDetailPath":"/data/v1/records/std-iso-31000-ead920a9.json","targetId":"std:iso-31000","type":"belongs_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:eb93282202b2513404526abe258f89148b8ba4a6f81b9f111b2615b15ead0ff3","properties":{"rationale":"","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-13-75b9f6c7.json","sourceId":"uc:UC-RISK-13","targetDetailPath":"/data/v1/records/risk-ops-product-service-quality-2066b257.json","targetId":"risk:ops-product-service-quality","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:f71b5fac8b1a27b328ed3fc4b12d4f7ae5bc4ee209c1f78b763be18d277cf457","properties":{"rationale":"EU AI Act Art 9 member extends the framework with a high-risk-AI risk-management system governing identification/mitigation of accuracy risks; framework enables, not operates, the defense.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-01-13d56297.json","sourceId":"uc:UC-RISK-01","targetDetailPath":"/data/v1/records/risk-ai-inaccurate-unreliable-output-cf10c86e.json","targetId":"risk:ai-inaccurate-unreliable-output","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:fb5f63e0e4615c9d3de78b8439b6113a2d37b7efaff930014bd9c9c2615d5c2f","properties":{"control_id":"31000-PR1","coverage":"full","delta":null,"framework":"iso-31000","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2018"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-05-e2fc10a6.json","sourceId":"uc:UC-RISK-05","targetDetailPath":"/data/v1/records/ctrl-iso-31000-31000-pr1-74420c90.json","targetId":"ctrl:iso-31000:31000-PR1","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:fd3702f43d19f090d9afe4ab6da6e51ea5ffeefd91cf92a393a00c3e8d411aad","properties":{"control_id":"31000-P7","coverage":"full","delta":null,"framework":"iso-31000","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2018"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-05-e2fc10a6.json","sourceId":"uc:UC-RISK-05","targetDetailPath":"/data/v1/records/ctrl-iso-31000-31000-p7-3d100675.json","targetId":"ctrl:iso-31000:31000-P7","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:ff1762d38f283946e3d7edd1baafa3f00bb0b032b46e5aca0769dea9b98ef814","properties":{"control_id":"31000-PR6","coverage":"full","delta":null,"framework":"iso-31000","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2018"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-09-06ffdff1.json","sourceId":"uc:UC-RISK-09","targetDetailPath":"/data/v1/records/ctrl-iso-31000-31000-pr6-07fe73a7.json","targetId":"ctrl:iso-31000:31000-PR6","type":"maps_to"}],"schemaVersion":1,"scope":"sources","total":85}