{
  "kind": "grc-template",
  "version": 1,
  "template": "control-inventory",
  "exportedAt": "2026-11-01T12:00:00+00:00",
  "fields": {
    "control": "ILLUSTRATIVE STARTER — replace with your own record. GRC-C06: Separate implementation from verified action closure\nRisk addressed: An issue is closed on the action owner's assertion before the agreed outcome has been checked.",
    "operation": "In this example, the action owner submits completion evidence; a designated reviewer compares it with agreed criteria and records the retest result before approving closure.\nSuggested operating trigger: an owner requests closure or a previously completed action fails in use.\nAssign the actual owner and frequency for your organisation.",
    "evidence": "Suggested evidence references — replace with your own:\n- The finding, agreed action and completion criteria.\n- The action owner's implementation evidence and submission date.\n- The review or retest record, limitations and closure decision.",
    "test": "SUGGESTED TEST — NOT PERFORMED. Select actions marked complete, including consequential findings; inspect whether the evidence demonstrates the agreed outcome and whether retesting occurred before closure. Identify claimed fixes awaiting verification.",
    "finding": "NOT TESTED. Record actual observations and the limitations of the review.\nPotential failure indicator: A closed action contains only an assurance statement, or the cited retest happened before the change was implemented.",
    "action": "Assign a specific outcome, accountable owner and planning date after reviewing the findings.",
    "retest": "NO RETEST PERFORMED. Keep claimed completion separate from actual verification."
  }
}