{
  "kind": "grc-template",
  "version": 1,
  "template": "control-inventory",
  "exportedAt": "2026-11-01T12:00:00+00:00",
  "fields": {
    "control": "ILLUSTRATIVE STARTER — replace with your own record. GRC-C12: Exercise the incident route with an unavailable contact\nRisk addressed: An incident response stalls when the usual decision-maker, supplier contact or communication channel is unavailable.",
    "operation": "In this example, a facilitator runs a clearly marked, bounded scenario with the actual responders, introduces an unavailable contact and records where authority or information cannot be located.\nSuggested review trigger: changed response roles or suppliers, an incident lesson or the agreed exercise programme.\nAssign the actual owner and frequency for your organisation.",
    "evidence": "Suggested evidence references — replace with your own:\n- The scenario objective, participants, boundaries and stop conditions.\n- A timeline of simulated developments, attempted decisions and information gaps.\n- The debrief, assigned improvements and results of repeating failed steps.",
    "test": "SUGGESTED TEST — NOT PERFORMED. Review an exercise record and follow one observed failure through its action and repeat test. Distinguish demonstrated response capability from an intention to update the plan.",
    "finding": "NOT TESTED. Record actual observations and the limitations of the review.\nPotential failure indicator: Responders cannot locate a fallback decision-maker, or a failed step recurs without evidence of follow-up.",
    "action": "Assign a specific outcome, accountable owner and planning date after reviewing the findings.",
    "retest": "NO RETEST PERFORMED. Keep claimed completion separate from actual verification."
  }
}