{
  "kind": "grc-template",
  "version": 1,
  "template": "control-inventory",
  "exportedAt": "2026-11-01T12:00:00+00:00",
  "fields": {
    "control": "ILLUSTRATIVE STARTER — replace with your own record. GRC-C07: Review a critical supplier before commitment\nRisk addressed: The organisation relies on a supplier without understanding service dependencies, assurance limits or exit obstacles.",
    "operation": "In this example, the service owner assesses the dependency, checks evidence for the actual service and submits unresolved gaps and approval conditions before selection or renewal.\nSuggested operating trigger: selection, renewal, a material subcontractor change or repeated service failure.\nAssign the actual owner and frequency for your organisation.",
    "evidence": "Suggested evidence references — replace with your own:\n- The supplier entity, service scope, access and dependency record.\n- Assurance evidence with its coverage, dates, exclusions and open findings identified.\n- The approval decision, monitoring conditions and exit assumptions requiring validation.",
    "test": "SUGGESTED TEST — NOT PERFORMED. Select a critical supplier added or renewed during the period; trace a material assurance claim to its source and inspect whether approval conditions were resolved or explicitly accepted.",
    "finding": "NOT TESTED. Record actual observations and the limitations of the review.\nPotential failure indicator: The assurance covers a different service or an unresolved dependency is missing from the approval decision.",
    "action": "Assign a specific outcome, accountable owner and planning date after reviewing the findings.",
    "retest": "NO RETEST PERFORMED. Keep claimed completion separate from actual verification."
  }
}