{
  "kind": "grc-template",
  "version": 1,
  "template": "control-inventory",
  "exportedAt": "2026-11-01T12:00:00+00:00",
  "fields": {
    "control": "ILLUSTRATIVE STARTER — replace with your own record. GRC-C15: Review a changed processing activity\nRisk addressed: A change to personal-data processing proceeds on an outdated description or an untested assumption about safeguards.",
    "operation": "In this example, the project owner maps the changed processing, records the relevant screening and assessment decisions, and obtains evidence that important safeguards have been implemented and checked.\nSuggested review trigger: a material change in purpose, scale, information, technology or supplier before the changed activity proceeds.\nAssign the actual owner and frequency for your organisation.",
    "evidence": "Suggested evidence references — replace with your own:\n- The current processing description and relevant information-flow changes.\n- The screening decision, reasons and references to restricted assessment records.\n- Safeguard implementation evidence, test results and unresolved questions.",
    "test": "SUGGESTED TEST — NOT PERFORMED. Choose a materially changed activity; compare the actual flow with the recorded description and trace one important safeguard to implementation and testing. Keep the review within its stated scope.",
    "finding": "NOT TESTED. Record actual observations and the limitations of the review.\nPotential failure indicator: The assessment describes the old information flow or lists a safeguard for which no implementation evidence can be found.",
    "action": "Assign a specific outcome, accountable owner and planning date after reviewing the findings.",
    "retest": "NO RETEST PERFORMED. Keep claimed completion separate from actual verification."
  }
}