{
  "kind": "grc-template",
  "version": 1,
  "template": "control-inventory",
  "exportedAt": "2026-11-01T12:00:00+00:00",
  "fields": {
    "control": "ILLUSTRATIVE STARTER — replace with your own record. GRC-C10: Review material service changes before rollout\nRisk addressed: A product, hosting or access change introduces exposure that the accountable service owner has not considered.",
    "operation": "In this example, the change owner records affected services and dependencies, gathers proportionate test evidence and obtains a decision on unresolved risks and rollout conditions.\nSuggested operating trigger: a material product, AI-use, hosting, supplier or access change before rollout.\nAssign the actual owner and frequency for your organisation.",
    "evidence": "Suggested evidence references — replace with your own:\n- The change description, affected service and risk assessment.\n- Relevant test results and the assumptions or dependencies left untested.\n- The approval, rollout conditions and subsequent check of the changed service.",
    "test": "SUGGESTED TEST — NOT PERFORMED. Select a material completed change; compare its approved scope with the implemented change and inspect how failed tests, exceptions and approval conditions were handled.",
    "finding": "NOT TESTED. Record actual observations and the limitations of the review.\nPotential failure indicator: The implemented change differs from the approved scope or an unresolved test finding has no accountable decision.",
    "action": "Assign a specific outcome, accountable owner and planning date after reviewing the findings.",
    "retest": "NO RETEST PERFORMED. Keep claimed completion separate from actual verification."
  }
}