{
  "kind": "grc-template",
  "version": 1,
  "template": "control-inventory",
  "exportedAt": "2026-11-01T12:00:00+00:00",
  "fields": {
    "control": "ILLUSTRATIVE STARTER — replace with your own record. GRC-C03: Review a policy against the work it governs\nRisk addressed: An approved policy becomes detached from the process staff actually use.",
    "operation": "In this example, the policy owner checks a current procedure and a real or clearly marked practice case, proposes corrections and obtains approval before communicating the revised version.\nSuggested review trigger: a service or system change, repeated workaround, incident finding or the organisation's chosen review point.\nAssign the actual owner and frequency for your organisation.",
    "evidence": "Suggested evidence references — replace with your own:\n- The policy register showing owner, approver and current version.\n- Walkthrough notes identifying where instructions matched or differed from practice.\n- The approved revision and evidence that affected staff received and understood the changes.",
    "test": "SUGGESTED TEST — NOT PERFORMED. Choose a policy changed during the review period; trace one substantive change from the identified problem through approval, communication and subsequent use. Keep document and implementation findings separate.",
    "finding": "NOT TESTED. Record actual observations and the limitations of the review.\nPotential failure indicator: Staff use a superseded version or the revised instruction still cannot be followed in the actual process.",
    "action": "Assign a specific outcome, accountable owner and planning date after reviewing the findings.",
    "retest": "NO RETEST PERFORMED. Keep claimed completion separate from actual verification."
  }
}