{
  "kind": "grc-template",
  "version": 1,
  "template": "control-inventory",
  "exportedAt": "2026-11-01T12:00:00+00:00",
  "fields": {
    "control": "ILLUSTRATIVE STARTER — replace with your own record. GRC-C08: Compare system access with current responsibilities\nRisk addressed: People retain access that no longer matches their role or the service's approved arrangements.",
    "operation": "In this example, the system owner compares current access with authorised responsibilities, obtains decisions on discrepancies and records the resulting access changes.\nSuggested operating trigger: a role, supplier or system-access change and the organisation's chosen access-review cycle.\nAssign the actual owner and frequency for your organisation.",
    "evidence": "Suggested evidence references — replace with your own:\n- A dated access listing for the system and review scope.\n- The authorised role or access requests used for comparison.\n- Recorded discrepancies, approval decisions and confirmation of changes made.",
    "test": "SUGGESTED TEST — NOT PERFORMED. Choose access changes and a sample of current accounts, including changed roles; compare authorisation with the access actually present and trace discrepancies to resolution. State coverage limitations.",
    "finding": "NOT TESTED. Record actual observations and the limitations of the review.\nPotential failure indicator: An account's access cannot be connected to a current authorised responsibility or a recorded removal remains unapplied.",
    "action": "Assign a specific outcome, accountable owner and planning date after reviewing the findings.",
    "retest": "NO RETEST PERFORMED. Keep claimed completion separate from actual verification."
  }
}