{
  "kind": "grc-template",
  "version": 1,
  "template": "control-inventory",
  "exportedAt": "2026-11-01T12:00:00+00:00",
  "fields": {
    "control": "ILLUSTRATIVE STARTER — replace with your own record. GRC-C04: Escalate a risk-limit exception\nRisk addressed: Exposure outside an agreed limit continues without an informed and authorised decision.",
    "operation": "In this example, the risk owner flags an agreed threshold breach; the authorised decision-maker records the response, any temporary safeguards and the scope and expiry of an accepted exception.\nSuggested operating trigger: an agreed limit is approached or exceeded, or an exception is nearing expiry.\nAssign the actual owner and frequency for your organisation.",
    "evidence": "Suggested evidence references — replace with your own:\n- The approved limit and escalation authority in use at the time.\n- The exception request with exposure, assumptions and proposed safeguards.\n- The decision, conditions, expiry and evidence of follow-up.",
    "test": "SUGGESTED TEST — NOT PERFORMED. Select recorded threshold breaches and exceptions; compare the response with the escalation rule and inspect whether conditions and expiry were reviewed. Record breaches found outside the exception log.",
    "finding": "NOT TESTED. Record actual observations and the limitations of the review.\nPotential failure indicator: An exception expires without review or the limit is retrospectively increased without a recorded decision.",
    "action": "Assign a specific outcome, accountable owner and planning date after reviewing the findings.",
    "retest": "NO RETEST PERFORMED. Keep claimed completion separate from actual verification."
  }
}