{
  "kind": "grc-template",
  "version": 1,
  "template": "control-inventory",
  "exportedAt": "2026-11-01T12:00:00+00:00",
  "fields": {
    "control": "ILLUSTRATIVE STARTER — replace with your own record. GRC-C11: Challenge risk-register changes with evidence\nRisk addressed: A risk assessment becomes stale or its residual score falls without evidence that current controls improved.",
    "operation": "In this example, the risk owner compares current exposure with the previous decision, checks control evidence and records the reasons for score changes, treatment choices and escalation.\nSuggested review trigger: a changed dependency, missed control, incident, near miss or agreed risk-review point.\nAssign the actual owner and frequency for your organisation.",
    "evidence": "Suggested evidence references — replace with your own:\n- The previous risk assessment, objective and rating assumptions.\n- Current control evidence, incidents, near misses and relevant changes.\n- The revised assessment, reasons, treatment decision and review trigger.",
    "test": "SUGGESTED TEST — NOT PERFORMED. Select risks with reduced residual ratings and risks affected by incidents; trace the change in assessment to current operating evidence and identify any planned controls counted prematurely.",
    "finding": "NOT TESTED. Record actual observations and the limitations of the review.\nPotential failure indicator: The residual score is reduced because a control is planned, or a material change leaves the old assessment untouched.",
    "action": "Assign a specific outcome, accountable owner and planning date after reviewing the findings.",
    "retest": "NO RETEST PERFORMED. Keep claimed completion separate from actual verification."
  }
}