{
  "kind": "grc-template",
  "version": 1,
  "template": "control-inventory",
  "exportedAt": "2026-11-01T12:00:00+00:00",
  "fields": {
    "control": "ILLUSTRATIVE STARTER — replace with your own record. GRC-C16: Check AML applicability when a service changes\nRisk addressed: A new or changed service inherits an AML scope or supervisory assumption that does not reflect the actual activity.",
    "operation": "In this example, the responsible practice or service owner records the activity, checks current applicable sources and supervisory context, and assigns unresolved scope questions before the service change is approved.\nSuggested operating trigger: a materially different service, relevant technology change or source update affecting the recorded assessment.\nAssign the actual owner and frequency for your organisation.",
    "evidence": "Suggested evidence references — replace with your own:\n- The service description and the activities included or excluded from review.\n- The source and supervisory references supporting the scope assessment.\n- The reasoned decision, outstanding advice questions and resulting procedure or risk-review actions.",
    "test": "SUGGESTED TEST — NOT PERFORMED. Select a new or materially changed service; compare its actual activities with the recorded scope rationale and inspect whether unresolved questions reached the appropriate decision-maker.",
    "finding": "NOT TESTED. Record actual observations and the limitations of the review.\nPotential failure indicator: The assessment relies only on the business label or imports another sector's guidance without checking relevance.",
    "action": "Assign a specific outcome, accountable owner and planning date after reviewing the findings.",
    "retest": "NO RETEST PERFORMED. Keep claimed completion separate from actual verification."
  }
}