{"catalogRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","kind":"index","name":"risk","next":"/controls/assets/agent_indexes-risk-2.4e4a851e85b390f2.json","page":1,"pageSize":100,"records":[{"attributes":{"category":"cyber_security","domain":["Access Control & Identity Management","Data Protection & Privacy"],"inherent_rating":"high","taxonomy":["iso-27005-vulnerability","nist-800-30-threat-event","nist-privacy-risk"]},"htmlUrl":"/controls/agents/records/risk-access-excess-privilege-cd8adadc.html","id":"risk:access-excess-privilege","title":"Excessive privilege and wrong assignment of access rights","type":"risk","url":"/controls/assets/agent_record-risk-access-excess-privilege-cd8adadc.262031aefb7a6ee9.json"},{"attributes":{"category":"cyber_security","domain":["Access Control & Identity Management","Logging, Monitoring & Detection"],"inherent_rating":"high","taxonomy":["iso-27005-threat","nist-800-30-threat-event","nist-800-30-threat-source"]},"htmlUrl":"/controls/agents/records/risk-access-privilege-abuse-repudiation-343a8917.html","id":"risk:access-privilege-abuse-repudiation","title":"Abuse of rights, forged rights, and repudiation of actions","type":"risk","url":"/controls/assets/agent_record-risk-access-privilege-abuse-repudiation-343a8917.2aa7c313cd30dfec.json"},{"attributes":{"category":"cyber_security","domain":["Access Control & Identity Management"],"inherent_rating":"high","taxonomy":["iso-27005-vulnerability"]},"htmlUrl":"/controls/agents/records/risk-access-provisioning-review-gap-dc152038.html","id":"risk:access-provisioning-review-gap","title":"Weak account provisioning/de-registration and access review","type":"risk","url":"/controls/assets/agent_record-risk-access-provisioning-review-gap-dc152038.817654b9de719c15.json"},{"attributes":{"category":"cyber_security","domain":["Access Control & Identity Management"],"inherent_rating":"medium","taxonomy":["iso-27005-threat","nist-800-30-threat-event"]},"htmlUrl":"/controls/agents/records/risk-access-unauthorized-use-equipment-d2082944.html","id":"risk:access-unauthorized-use-equipment","title":"Unauthorized use of equipment and unauthorized access escalation","type":"risk","url":"/controls/assets/agent_record-risk-access-unauthorized-use-equipment-d2082944.a13a1c8c5ede006c.json"},{"attributes":{"category":"cyber_security","domain":["Access Control & Identity Management","Network & Communications Security"],"inherent_rating":"high","taxonomy":["iso-27005-vulnerability","nist-800-30-threat-event"]},"htmlUrl":"/controls/agents/records/risk-access-weak-authentication-4e35bdb2.html","id":"risk:access-weak-authentication","title":"Weak authentication and password management","type":"risk","url":"/controls/assets/agent_record-risk-access-weak-authentication-4e35bdb2.0a2efe020cc7b6ce.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Governance, Policy & Oversight","Compliance, Audit & Assurance"],"inherent_rating":"high","taxonomy":["nist-ai-rmf-risk","iso-23894-ai-risk"]},"htmlUrl":"/controls/agents/records/risk-ai-accountability-liability-193b3f72.html","id":"risk:ai-accountability-liability","title":"AI accountability gaps and organizational liability","type":"risk","url":"/controls/assets/agent_record-risk-ai-accountability-liability-193b3f72.cd25618378ea589d.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Secure Development (SDLC) & Application Security","Vulnerability & Patch Management"],"inherent_rating":"high","taxonomy":["nist-ai-rmf-risk","iso-23894-ai-risk"]},"htmlUrl":"/controls/agents/records/risk-ai-adversarial-poisoning-attacks-ea7df068.html","id":"risk:ai-adversarial-poisoning-attacks","title":"Adversarial attacks, data poisoning and prompt injection","type":"risk","url":"/controls/assets/agent_record-risk-ai-adversarial-poisoning-attacks-ea7df068.9c0f579cd430668e.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Access Control & Identity Management"],"inherent_rating":"high","taxonomy":["owasp-llm-top10-2025","iso-23894-ai-risk"]},"htmlUrl":"/controls/agents/records/risk-ai-agent-unauthorized-actions-194415b8.html","id":"risk:ai-agent-unauthorized-actions","title":"Unauthorized or unsafe autonomous agent actions and tool calls","type":"risk","url":"/controls/assets/agent_record-risk-ai-agent-unauthorized-actions-194415b8.7fd5c6b9df9aba40.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Data Protection & Privacy","Compliance, Audit & Assurance"],"inherent_rating":"high","taxonomy":["nist-ai-rmf-risk","iso-23894-ai-risk","nist-privacy-risk"]},"htmlUrl":"/controls/agents/records/risk-ai-bias-discrimination-35faf209.html","id":"risk:ai-bias-discrimination","title":"Harmful AI bias and discrimination against protected groups","type":"risk","url":"/controls/assets/agent_record-risk-ai-bias-discrimination-35faf209.4b7ecaf32e334181.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance"],"inherent_rating":"high","taxonomy":["nist-ai-rmf-risk","iso-23894-ai-risk"]},"htmlUrl":"/controls/agents/records/risk-ai-catastrophic-cyber-misuse-6bced10d.html","id":"risk:ai-catastrophic-cyber-misuse","title":"Misuse of AI systems for offensive cyber operations or catastrophic harm","type":"risk","url":"/controls/assets/agent_record-risk-ai-catastrophic-cyber-misuse-6bced10d.29686a443f611594.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Secure Development (SDLC) & Application Security"],"inherent_rating":"medium","taxonomy":["iso-23894-ai-risk"]},"htmlUrl":"/controls/agents/records/risk-ai-emergent-integration-risk-8490271c.html","id":"risk:ai-emergent-integration-risk","title":"Emergent behaviour and unsafe AI system integration","type":"risk","url":"/controls/assets/agent_record-risk-ai-emergent-integration-risk-8490271c.b7cb2bffee6f254e.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Network & Communications Security"],"inherent_rating":"medium","taxonomy":["owasp-llm-top10-2025","nist-ai-rmf-risk"]},"htmlUrl":"/controls/agents/records/risk-ai-endpoint-abuse-model-extraction-a3c97c52.html","id":"risk:ai-endpoint-abuse-model-extraction","title":"AI endpoint abuse, scraping and model extraction","type":"risk","url":"/controls/assets/agent_record-risk-ai-endpoint-abuse-model-extraction-a3c97c52.987116c1eddc38a1.json"},{"attributes":{"category":"esg","domain":["AI Governance","Risk Assessment & Management"],"inherent_rating":"low","taxonomy":["iso-23894-ai-risk"]},"htmlUrl":"/controls/agents/records/risk-ai-environmental-footprint-c86cf6c9.html","id":"risk:ai-environmental-footprint","title":"Environmental footprint of AI training and infrastructure","type":"risk","url":"/controls/assets/agent_record-risk-ai-environmental-footprint-c86cf6c9.633881c9a1eaddaa.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Third-Party / Supply-Chain Risk","Compliance, Audit & Assurance"],"inherent_rating":"high","taxonomy":["eu-ai-act-risk","nist-ai-rmf-risk"]},"htmlUrl":"/controls/agents/records/risk-ai-gpai-systemic-transparency-7a746323.html","id":"risk:ai-gpai-systemic-transparency","title":"GPAI transparency, systemic-risk and synthetic-content obligations","type":"risk","url":"/controls/assets/agent_record-risk-ai-gpai-systemic-transparency-7a746323.8546f1714f47c810.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Data Protection & Privacy","Compliance, Audit & Assurance"],"inherent_rating":"high","taxonomy":["eu-ai-act-risk"]},"htmlUrl":"/controls/agents/records/risk-ai-highrisk-biometrics-c23b524a.html","id":"risk:ai-highrisk-biometrics","title":"Rights harm from biometric-identification AI","type":"risk","url":"/controls/assets/agent_record-risk-ai-highrisk-biometrics-c23b524a.af4c9885226626b0.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Business Continuity & Disaster Recovery","Compliance, Audit & Assurance"],"inherent_rating":"high","taxonomy":["eu-ai-act-risk"]},"htmlUrl":"/controls/agents/records/risk-ai-highrisk-critical-infra-a7a37365.html","id":"risk:ai-highrisk-critical-infra","title":"Public-safety harm from AI in critical infrastructure","type":"risk","url":"/controls/assets/agent_record-risk-ai-highrisk-critical-infra-a7a37365.838b6206fb3e33c2.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Compliance, Audit & Assurance"],"inherent_rating":"medium","taxonomy":["eu-ai-act-risk"]},"htmlUrl":"/controls/agents/records/risk-ai-highrisk-education-fe20b899.html","id":"risk:ai-highrisk-education","title":"Unfair exclusion by AI in education and training","type":"risk","url":"/controls/assets/agent_record-risk-ai-highrisk-education-fe20b899.910e71f18b450a93.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Human Resources / Personnel Security","Compliance, Audit & Assurance"],"inherent_rating":"high","taxonomy":["eu-ai-act-risk"]},"htmlUrl":"/controls/agents/records/risk-ai-highrisk-employment-f50a88ef.html","id":"risk:ai-highrisk-employment","title":"Discriminatory outcomes from AI in employment","type":"risk","url":"/controls/assets/agent_record-risk-ai-highrisk-employment-f50a88ef.1d2285af1ae69353.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Financial Reporting Controls (SOX)","Compliance, Audit & Assurance"],"inherent_rating":"high","taxonomy":["eu-ai-act-risk"]},"htmlUrl":"/controls/agents/records/risk-ai-highrisk-essential-services-46de2ea9.html","id":"risk:ai-highrisk-essential-services","title":"Unlawful denial of essential services by AI","type":"risk","url":"/controls/assets/agent_record-risk-ai-highrisk-essential-services-46de2ea9.05987940b014ad3e.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Governance, Policy & Oversight","Compliance, Audit & Assurance"],"inherent_rating":"high","taxonomy":["eu-ai-act-risk"]},"htmlUrl":"/controls/agents/records/risk-ai-highrisk-justice-democracy-7f7e4bfd.html","id":"risk:ai-highrisk-justice-democracy","title":"Harm to due process and democratic integrity from AI","type":"risk","url":"/controls/assets/agent_record-risk-ai-highrisk-justice-democracy-7f7e4bfd.e09974f15ad17b1e.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Data Protection & Privacy","Compliance, Audit & Assurance"],"inherent_rating":"high","taxonomy":["eu-ai-act-risk"]},"htmlUrl":"/controls/agents/records/risk-ai-highrisk-law-enforcement-7d4537e1.html","id":"risk:ai-highrisk-law-enforcement","title":"Rights violations from AI in law enforcement","type":"risk","url":"/controls/assets/agent_record-risk-ai-highrisk-law-enforcement-7d4537e1.0e50b2a1c43935bb.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Data Protection & Privacy","Compliance, Audit & Assurance"],"inherent_rating":"high","taxonomy":["eu-ai-act-risk"]},"htmlUrl":"/controls/agents/records/risk-ai-highrisk-migration-border-47d2b2d8.html","id":"risk:ai-highrisk-migration-border","title":"Wrongful denial by AI in migration and border control","type":"risk","url":"/controls/assets/agent_record-risk-ai-highrisk-migration-border-47d2b2d8.f15f196ea81bed1a.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Risk Assessment & Management"],"inherent_rating":"high","taxonomy":["nist-ai-rmf-risk","iso-23894-ai-risk"]},"htmlUrl":"/controls/agents/records/risk-ai-inaccurate-unreliable-output-cf10c86e.html","id":"risk:ai-inaccurate-unreliable-output","title":"Inaccurate, unreliable or hallucinated AI outputs","type":"risk","url":"/controls/assets/agent_record-risk-ai-inaccurate-unreliable-output-cf10c86e.489d817d48a7d966.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Governance, Policy & Oversight"],"inherent_rating":"medium","taxonomy":["iso-23894-ai-risk"]},"htmlUrl":"/controls/agents/records/risk-ai-inappropriate-task-allocation-72a18be5.html","id":"risk:ai-inappropriate-task-allocation","title":"Inappropriate human/AI task allocation and end-of-life risk","type":"risk","url":"/controls/assets/agent_record-risk-ai-inappropriate-task-allocation-72a18be5.f1a89c7e0c6b4132.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Secure Development (SDLC) & Application Security"],"inherent_rating":"high","taxonomy":["owasp-llm-top10-2025"]},"htmlUrl":"/controls/agents/records/risk-ai-insecure-generated-code-ec50f0f9.html","id":"risk:ai-insecure-generated-code","title":"Insecure AI-generated code and hallucinated or typosquatted dependencies","type":"risk","url":"/controls/assets/agent_record-risk-ai-insecure-generated-code-ec50f0f9.6a2b64bb7bd66db0.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Governance, Policy & Oversight"],"inherent_rating":"high","taxonomy":["nist-ai-rmf-risk","iso-23894-ai-risk","eu-ai-act-risk"]},"htmlUrl":"/controls/agents/records/risk-ai-insufficient-human-oversight-6c4f3dfa.html","id":"risk:ai-insufficient-human-oversight","title":"Insufficient human oversight and automation complacency","type":"risk","url":"/controls/assets/agent_record-risk-ai-insufficient-human-oversight-6c4f3dfa.0b77dcf560d5ecb1.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Governance, Policy & Oversight"],"inherent_rating":"medium","taxonomy":["nist-ai-rmf-risk","iso-23894-ai-risk","eu-ai-act-risk"]},"htmlUrl":"/controls/agents/records/risk-ai-lack-explainability-transparency-edbd29e2.html","id":"risk:ai-lack-explainability-transparency","title":"Lack of AI explainability, documentation and disclosure","type":"risk","url":"/controls/assets/agent_record-risk-ai-lack-explainability-transparency-edbd29e2.49db29267909b980.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Logging, Monitoring & Detection"],"inherent_rating":"high","taxonomy":["nist-ai-rmf-risk","iso-23894-ai-risk","eu-ai-act-risk"]},"htmlUrl":"/controls/agents/records/risk-ai-model-drift-monitoring-15329f38.html","id":"risk:ai-model-drift-monitoring","title":"Model/data drift and inadequate post-deployment monitoring","type":"risk","url":"/controls/assets/agent_record-risk-ai-model-drift-monitoring-15329f38.8ee67dc7283ff7d6.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Business Continuity & Disaster Recovery"],"inherent_rating":"medium","taxonomy":["nist-ai-rmf-risk"]},"htmlUrl":"/controls/agents/records/risk-ai-model-resilience-fallback-gap-85070995.html","id":"risk:ai-model-resilience-fallback-gap","title":"Insufficient AI resilience and fallback mechanisms","type":"risk","url":"/controls/assets/agent_record-risk-ai-model-resilience-fallback-gap-85070995.39700019e2510918.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Data Protection & Privacy"],"inherent_rating":"high","taxonomy":["iso-23894-ai-risk","eu-ai-act-risk"]},"htmlUrl":"/controls/agents/records/risk-ai-poor-training-data-quality-95872765.html","id":"risk:ai-poor-training-data-quality","title":"Poor-quality, unrepresentative or mislabeled training data","type":"risk","url":"/controls/assets/agent_record-risk-ai-poor-training-data-quality-95872765.11837608e9f6cccf.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Risk Assessment & Management"],"inherent_rating":"medium","taxonomy":["nist-ai-rmf-risk"]},"htmlUrl":"/controls/agents/records/risk-ai-power-concentration-societal-473c979a.html","id":"risk:ai-power-concentration-societal","title":"AI power concentration and erosion of societal trust","type":"risk","url":"/controls/assets/agent_record-risk-ai-power-concentration-societal-473c979a.86f20f7c82e4abc5.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Data Protection & Privacy"],"inherent_rating":"high","taxonomy":["nist-ai-rmf-risk","nist-privacy-risk"]},"htmlUrl":"/controls/agents/records/risk-ai-privacy-leakage-9aa8d83c.html","id":"risk:ai-privacy-leakage","title":"AI privacy leakage and re-identification","type":"risk","url":"/controls/assets/agent_record-risk-ai-privacy-leakage-9aa8d83c.8c0de613b4335606.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Compliance, Audit & Assurance"],"inherent_rating":"high","taxonomy":["eu-ai-act-risk"]},"htmlUrl":"/controls/agents/records/risk-ai-prohibited-practices-daf993e5.html","id":"risk:ai-prohibited-practices","title":"Deployment of prohibited AI practices (EU AI Act Art.5)","type":"risk","url":"/controls/assets/agent_record-risk-ai-prohibited-practices-daf993e5.2a5307a078a7b36d.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Risk Assessment & Management"],"inherent_rating":"high","taxonomy":["nist-ai-rmf-risk","iso-23894-ai-risk"]},"htmlUrl":"/controls/agents/records/risk-ai-safety-harm-to-people-d02cb500.html","id":"risk:ai-safety-harm-to-people","title":"AI safety failures causing physical or psychological harm","type":"risk","url":"/controls/assets/agent_record-risk-ai-safety-harm-to-people-d02cb500.ce1d4c30712d9bf6.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Data Protection & Privacy","Cryptography & Key Management"],"inherent_rating":"high","taxonomy":["owasp-llm-top10-2025","nist-ai-rmf-risk"]},"htmlUrl":"/controls/agents/records/risk-ai-secrets-credential-leakage-abf1bf77.html","id":"risk:ai-secrets-credential-leakage","title":"Credential and secret leakage through AI inputs, outputs, logs and generated code","type":"risk","url":"/controls/assets/agent_record-risk-ai-secrets-credential-leakage-abf1bf77.841ad3b7f80f6db5.json"},{"attributes":{"category":"ai_governance","domain":["AI Governance","Third-Party / Supply-Chain Risk","Secure Development (SDLC) & Application Security"],"inherent_rating":"high","taxonomy":["nist-ai-rmf-risk","iso-23894-ai-risk","eu-ai-act-risk"]},"htmlUrl":"/controls/agents/records/risk-ai-supply-chain-concentration-9f791f54.html","id":"risk:ai-supply-chain-concentration","title":"AI supply-chain compromise and provider concentration","type":"risk","url":"/controls/assets/agent_record-risk-ai-supply-chain-concentration-9f791f54.83bb5005c31a9c2d.json"},{"attributes":{"category":"operational","domain":["Asset Management & Inventory","Business Continuity & Disaster Recovery"],"inherent_rating":"medium","taxonomy":["iso-27005-vulnerability","nist-800-30-threat-event"]},"htmlUrl":"/controls/agents/records/risk-asset-aging-hardware-no-replacement-f3ed1c2c.html","id":"risk:asset-aging-hardware-no-replacement","title":"Aging hardware with no periodic replacement scheme","type":"risk","url":"/controls/assets/agent_record-risk-asset-aging-hardware-no-replacement-f3ed1c2c.3b8f6914b8f8c142.json"},{"attributes":{"category":"operational","domain":["Asset Management & Inventory","Data Protection & Privacy"],"inherent_rating":"medium","taxonomy":["iso-27005-vulnerability"]},"htmlUrl":"/controls/agents/records/risk-asset-inventory-gap-e18c7e73.html","id":"risk:asset-inventory-gap","title":"Incomplete asset inventory and classification","type":"risk","url":"/controls/assets/agent_record-risk-asset-inventory-gap-e18c7e73.4df3be82dad70332.json"},{"attributes":{"category":"cyber_security","domain":["Asset Management & Inventory","Secure Configuration & Change Management"],"inherent_rating":"medium","taxonomy":["iso-27005-vulnerability","iso-27005-threat"]},"htmlUrl":"/controls/agents/records/risk-asset-uncontrolled-copying-removable-media-4a9604c7.html","id":"risk:asset-uncontrolled-copying-removable-media","title":"Uncontrolled copying to removable media / unmanaged software installs","type":"risk","url":"/controls/assets/agent_record-risk-asset-uncontrolled-copying-removable-media-4a9604c7.22cabe1ebe7d247b.json"},{"attributes":{"category":"cyber_security","domain":["Awareness & Training","Human Resources / Personnel Security"],"inherent_rating":"high","taxonomy":["iso-27005-vulnerability","nist-privacy-risk"]},"htmlUrl":"/controls/agents/records/risk-aware-insufficient-training-7cb09d2f.html","id":"risk:aware-insufficient-training","title":"Inadequate security awareness and training","type":"risk","url":"/controls/assets/agent_record-risk-aware-insufficient-training-7cb09d2f.70ee8c22a16f43b5.json"},{"attributes":{"category":"cyber_security","domain":["Awareness & Training","Data Protection & Privacy"],"inherent_rating":"medium","taxonomy":["iso-27005-vulnerability"]},"htmlUrl":"/controls/agents/records/risk-aware-no-acceptable-use-policy-e874ca5c.html","id":"risk:aware-no-acceptable-use-policy","title":"No acceptable-use policy for messaging and telecoms","type":"risk","url":"/controls/assets/agent_record-risk-aware-no-acceptable-use-policy-e874ca5c.f5f85219bd1d8b25.json"},{"attributes":{"category":"cyber_security","domain":["Awareness & Training","Access Control & Identity Management"],"inherent_rating":"critical","taxonomy":["nist-800-30-threat-event","basel-operational-risk"]},"htmlUrl":"/controls/agents/records/risk-aware-phishing-social-engineering-bb9b7bd6.html","id":"risk:aware-phishing-social-engineering","title":"Phishing, spear-phishing and social engineering","type":"risk","url":"/controls/assets/agent_record-risk-aware-phishing-social-engineering-bb9b7bd6.467fc5d7854a5438.json"},{"attributes":{"category":"cyber_security","domain":["Awareness & Training","Human Resources / Personnel Security"],"inherent_rating":"medium","taxonomy":["iso-27005-vulnerability","nist-privacy-risk"]},"htmlUrl":"/controls/agents/records/risk-aware-role-based-training-gap-3e2ca2c3.html","id":"risk:aware-role-based-training-gap","title":"Missing role-based and ongoing security/privacy training","type":"risk","url":"/controls/assets/agent_record-risk-aware-role-based-training-gap-3e2ca2c3.2a6fca6d58f3391c.json"},{"attributes":{"category":"operational","domain":["Awareness & Training","Data Protection & Privacy","Logging, Monitoring & Detection"],"inherent_rating":"high","taxonomy":["iso-27005-threat","nist-800-30-threat-event","nist-800-30-threat-source","iso-27005-vulnerability"]},"htmlUrl":"/controls/agents/records/risk-aware-user-error-mishandling-149a1d3b.html","id":"risk:aware-user-error-mishandling","title":"User error and mishandling of sensitive information","type":"risk","url":"/controls/assets/agent_record-risk-aware-user-error-mishandling-149a1d3b.2e9eaa6d5db578aa.json"},{"attributes":{"category":"business_continuity","domain":["Business Continuity & Disaster Recovery","Logging, Monitoring & Detection"],"inherent_rating":"high","taxonomy":["coso-erm-risk","basel-operational-risk"]},"htmlUrl":"/controls/agents/records/risk-bcdr-it-resilience-outage-18dfc108.html","id":"risk:bcdr-it-resilience-outage","title":"IT resilience failure — unplanned outage, data loss, slow recovery","type":"risk","url":"/controls/assets/agent_record-risk-bcdr-it-resilience-outage-18dfc108.ebd4813616246754.json"},{"attributes":{"category":"business_continuity","domain":["Business Continuity & Disaster Recovery","Risk Assessment & Management"],"inherent_rating":"high","taxonomy":["enterprise-risk","coso-erm-risk","iso-27005-vulnerability"]},"htmlUrl":"/controls/agents/records/risk-bcdr-no-tested-continuity-plan-d4d9e7a9.html","id":"risk:bcdr-no-tested-continuity-plan","title":"Absent or untested business continuity / disaster recovery plan","type":"risk","url":"/controls/assets/agent_record-risk-bcdr-no-tested-continuity-plan-d4d9e7a9.9194711a05b9ba1e.json"},{"attributes":{"category":"business_continuity","domain":["Business Continuity & Disaster Recovery","Network & Communications Security"],"inherent_rating":"high","taxonomy":["enterprise-risk","iso-27005-vulnerability","nist-800-30-threat-event"]},"htmlUrl":"/controls/agents/records/risk-bcdr-single-point-concentration-91008453.html","id":"risk:bcdr-single-point-concentration","title":"Single-site / single-region / single-supply concentration","type":"risk","url":"/controls/assets/agent_record-risk-bcdr-single-point-concentration-91008453.6aad6f623530d08d.json"},{"attributes":{"category":"compliance_regulatory","domain":["Compliance, Audit & Assurance","Risk Assessment & Management"],"inherent_rating":"medium","taxonomy":["basel-operational-risk"]},"htmlUrl":"/controls/agents/records/risk-compliance-client-suitability-fiduciary-2212ad74.html","id":"risk:compliance-client-suitability-fiduciary","title":"Client suitability, disclosure and fiduciary breaches","type":"risk","url":"/controls/assets/agent_record-risk-compliance-client-suitability-fiduciary-2212ad74.6ec291138f768117.json"},{"attributes":{"category":"compliance_regulatory","domain":["Compliance, Audit & Assurance","Risk Assessment & Management"],"inherent_rating":"medium","taxonomy":["enterprise-risk"]},"htmlUrl":"/controls/agents/records/risk-compliance-environmental-regulatory-5adf55ce.html","id":"risk:compliance-environmental-regulatory","title":"Environmental regulatory non-compliance","type":"risk","url":"/controls/assets/agent_record-risk-compliance-environmental-regulatory-5adf55ce.1af2f002c68e1b8c.json"},{"attributes":{"category":"compliance_regulatory","domain":["Compliance, Audit & Assurance","Governance, Policy & Oversight"],"inherent_rating":"high","taxonomy":["basel-operational-risk"]},"htmlUrl":"/controls/agents/records/risk-compliance-improper-market-practices-9c55cfe9.html","id":"risk:compliance-improper-market-practices","title":"Improper business or market practices","type":"risk","url":"/controls/assets/agent_record-risk-compliance-improper-market-practices-9c55cfe9.ae21ce1846a56a1f.json"},{"attributes":{"category":"compliance_regulatory","domain":["Compliance, Audit & Assurance","Asset Management & Inventory"],"inherent_rating":"medium","taxonomy":["enterprise-risk","coso-erm-risk"]},"htmlUrl":"/controls/agents/records/risk-compliance-ip-infringement-337b44a1.html","id":"risk:compliance-ip-infringement","title":"Intellectual property loss or infringement","type":"risk","url":"/controls/assets/agent_record-risk-compliance-ip-infringement-337b44a1.7c3fb729f7421f8c.json"},{"attributes":{"category":"compliance_regulatory","domain":["Compliance, Audit & Assurance","Governance, Policy & Oversight"],"inherent_rating":"high","taxonomy":["enterprise-risk","coso-erm-risk"]},"htmlUrl":"/controls/agents/records/risk-compliance-litigation-enforcement-25e7935d.html","id":"risk:compliance-litigation-enforcement","title":"Litigation, investigation and enforcement exposure","type":"risk","url":"/controls/assets/agent_record-risk-compliance-litigation-enforcement-25e7935d.8d42952e4cf97f71.json"},{"attributes":{"category":"compliance_regulatory","domain":["Compliance, Audit & Assurance","Governance, Policy & Oversight"],"inherent_rating":"medium","taxonomy":["iso-27005-vulnerability","coso-erm-risk"]},"htmlUrl":"/controls/agents/records/risk-compliance-no-independent-audit-9e1acf0f.html","id":"risk:compliance-no-independent-audit","title":"Lack of independent audit and compliance review","type":"risk","url":"/controls/assets/agent_record-risk-compliance-no-independent-audit-9e1acf0f.76944b6c371b7a71.json"},{"attributes":{"category":"compliance_regulatory","domain":["Compliance, Audit & Assurance","Risk Assessment & Management"],"inherent_rating":"medium","taxonomy":["coso-erm-risk"]},"htmlUrl":"/controls/agents/records/risk-compliance-regulatory-policy-change-9429f25b.html","id":"risk:compliance-regulatory-policy-change","title":"Adverse regulatory or policy change","type":"risk","url":"/controls/assets/agent_record-risk-compliance-regulatory-policy-change-9429f25b.3f5ee1f246ef7970.json"},{"attributes":{"category":"compliance_regulatory","domain":["Compliance, Audit & Assurance","Risk Assessment & Management"],"inherent_rating":"high","taxonomy":["enterprise-risk","coso-erm-risk"]},"htmlUrl":"/controls/agents/records/risk-compliance-sector-regulatory-breach-5eb29698.html","id":"risk:compliance-sector-regulatory-breach","title":"Sector regulatory non-compliance (financial, healthcare, trade)","type":"risk","url":"/controls/assets/agent_record-risk-compliance-sector-regulatory-breach-5eb29698.2e46c6939f15bcc5.json"},{"attributes":{"category":"compliance_regulatory","domain":["Risk Assessment & Management","Compliance, Audit & Assurance"],"inherent_rating":"medium","taxonomy":["basel-operational-risk"]},"htmlUrl":"/controls/agents/records/risk-compliance-selection-exposure-limits-8640d0d6.html","id":"risk:compliance-selection-exposure-limits","title":"Client selection, sponsorship and exposure-limit breaches","type":"risk","url":"/controls/assets/agent_record-risk-compliance-selection-exposure-limits-8640d0d6.e204517c600b2caf.json"},{"attributes":{"category":"cyber_security","domain":["Secure Configuration & Change Management","Network & Communications Security","Vulnerability & Patch Management"],"inherent_rating":"high","taxonomy":["nist-800-30-threat-event"]},"htmlUrl":"/controls/agents/records/risk-config-internet-exposed-misconfig-61b3613a.html","id":"risk:config-internet-exposed-misconfig","title":"Internet-exposed or misconfigured systems","type":"risk","url":"/controls/assets/agent_record-risk-config-internet-exposed-misconfig-61b3613a.cbbc090c7aa43fef.json"},{"attributes":{"category":"cyber_security","domain":["Secure Configuration & Change Management","Vulnerability & Patch Management"],"inherent_rating":"high","taxonomy":["iso-27005-vulnerability","nist-800-30-threat-event"]},"htmlUrl":"/controls/agents/records/risk-config-poor-baseline-drift-2dd66324.html","id":"risk:config-poor-baseline-drift","title":"Poor configuration management and insecure baseline drift","type":"risk","url":"/controls/assets/agent_record-risk-config-poor-baseline-drift-2dd66324.87c116a53c124967.json"},{"attributes":{"category":"cyber_security","domain":["Secure Configuration & Change Management","Secure Development (SDLC) & Application Security"],"inherent_rating":"medium","taxonomy":["iso-27005-vulnerability"]},"htmlUrl":"/controls/agents/records/risk-config-weak-change-control-e7d90eaf.html","id":"risk:config-weak-change-control","title":"Absent or weak change-control procedures","type":"risk","url":"/controls/assets/agent_record-risk-config-weak-change-control-e7d90eaf.875b26515e3cc359.json"},{"attributes":{"category":"cyber_security","domain":["Cryptography & Key Management","Network & Communications Security"],"inherent_rating":"high","taxonomy":["iso-27005-vulnerability"]},"htmlUrl":"/controls/agents/records/risk-crypto-cleartext-credential-transfer-b88065a1.html","id":"risk:crypto-cleartext-credential-transfer","title":"Credentials and sensitive data transmitted in clear text","type":"risk","url":"/controls/assets/agent_record-risk-crypto-cleartext-credential-transfer-b88065a1.255ebd618d55625d.json"},{"attributes":{"category":"cyber_security","domain":["Cryptography & Key Management","Network & Communications Security"],"inherent_rating":"high","taxonomy":["nist-800-30-threat-event"]},"htmlUrl":"/controls/agents/records/risk-crypto-counterfeit-certificates-d9dcc5c5.html","id":"risk:crypto-counterfeit-certificates","title":"Compromised or counterfeit certificates / certificate authority","type":"risk","url":"/controls/assets/agent_record-risk-crypto-counterfeit-certificates-d9dcc5c5.a3dad6002a522eae.json"},{"attributes":{"category":"cyber_security","domain":["Cryptography & Key Management","Data Protection & Privacy","Network & Communications Security"],"inherent_rating":"high","taxonomy":["iso-27005-vulnerability","nist-800-30-threat-event","nist-privacy-risk"]},"htmlUrl":"/controls/agents/records/risk-crypto-weak-or-absent-encryption-2fe7d24e.html","id":"risk:crypto-weak-or-absent-encryption","title":"Weak or absent encryption and key management","type":"risk","url":"/controls/assets/agent_record-risk-crypto-weak-or-absent-encryption-2fe7d24e.716704d709575ba5.json"},{"attributes":{"category":"cyber_security","domain":["Risk Assessment & Management","Logging, Monitoring & Detection"],"inherent_rating":"high","taxonomy":["nist-800-30-threat-source"]},"htmlUrl":"/controls/agents/records/risk-cyber-adversary-threat-sources-fa9e3003.html","id":"risk:cyber-adversary-threat-sources","title":"Attacks by capable, motivated threat actors","type":"risk","url":"/controls/assets/agent_record-risk-cyber-adversary-threat-sources-fa9e3003.9a0e4fd319a9d4c2.json"},{"attributes":{"category":"cyber_security","domain":["Logging, Monitoring & Detection","Incident Management & Response","Network & Communications Security"],"inherent_rating":"high","taxonomy":["nist-800-30-threat-event"]},"htmlUrl":"/controls/agents/records/risk-cyber-coordinated-campaign-b5879769.html","id":"risk:cyber-coordinated-campaign","title":"Coordinated multi-stage / APT campaigns","type":"risk","url":"/controls/assets/agent_record-risk-cyber-coordinated-campaign-b5879769.f7706a785c7bc4a5.json"},{"attributes":{"category":"cyber_security","domain":["Logging, Monitoring & Detection","Network & Communications Security"],"inherent_rating":"medium","taxonomy":["nist-800-30-threat-event"]},"htmlUrl":"/controls/agents/records/risk-cyber-reconnaissance-3a7a6c33.html","id":"risk:cyber-reconnaissance","title":"Adversary reconnaissance and information gathering","type":"risk","url":"/controls/assets/agent_record-risk-cyber-reconnaissance-3a7a6c33.8f5249b184394c78.json"},{"attributes":{"category":"privacy","domain":["Data Protection & Privacy","Incident Management & Response"],"inherent_rating":"high","taxonomy":["iso-27005-threat","nist-800-30-threat-event","nist-privacy-risk"]},"htmlUrl":"/controls/agents/records/risk-data-breach-unauthorized-disclosure-3b1c296c.html","id":"risk:data-breach-unauthorized-disclosure","title":"Unauthorized disclosure / breach of sensitive information","type":"risk","url":"/controls/assets/agent_record-risk-data-breach-unauthorized-disclosure-3b1c296c.f0b856b997ae8393.json"},{"attributes":{"category":"cyber_security","domain":["Data Protection & Privacy","Secure Development (SDLC) & Application Security"],"inherent_rating":"high","taxonomy":["iso-27005-threat","nist-800-30-threat-event"]},"htmlUrl":"/controls/agents/records/risk-data-corruption-integrity-loss-e771738a.html","id":"risk:data-corruption-integrity-loss","title":"Corruption or integrity loss of critical data","type":"risk","url":"/controls/assets/agent_record-risk-data-corruption-integrity-loss-e771738a.0252cfaa77792307.json"},{"attributes":{"category":"privacy","domain":["Data Protection & Privacy"],"inherent_rating":"high","taxonomy":["nist-privacy-risk"]},"htmlUrl":"/controls/agents/records/risk-data-excessive-collection-purpose-creep-4a691595.html","id":"risk:data-excessive-collection-purpose-creep","title":"Excessive collection, purpose creep and secondary use","type":"risk","url":"/controls/assets/agent_record-risk-data-excessive-collection-purpose-creep-4a691595.ccdae516b26e608d.json"},{"attributes":{"category":"cyber_security","domain":["Data Protection & Privacy","Network & Communications Security","Logging, Monitoring & Detection"],"inherent_rating":"critical","taxonomy":["nist-800-30-threat-event","nist-800-30-threat-source","basel-operational-risk","coso-erm-risk"]},"htmlUrl":"/controls/agents/records/risk-data-exfiltration-espionage-74803ebc.html","id":"risk:data-exfiltration-espionage","title":"Data exfiltration and theft of information by attackers","type":"risk","url":"/controls/assets/agent_record-risk-data-exfiltration-espionage-74803ebc.e4e88913474745c6.json"},{"attributes":{"category":"privacy","domain":["Data Protection & Privacy","Asset Management & Inventory"],"inherent_rating":"medium","taxonomy":["nist-privacy-risk"]},"htmlUrl":"/controls/agents/records/risk-data-inventory-flows-unmapped-fd7746f8.html","id":"risk:data-inventory-flows-unmapped","title":"Undocumented data inventory and unmapped data flows","type":"risk","url":"/controls/assets/agent_record-risk-data-inventory-flows-unmapped-fd7746f8.e2cba614f7ba8ce9.json"},{"attributes":{"category":"privacy","domain":["Data Protection & Privacy","AI Governance"],"inherent_rating":"medium","taxonomy":["nist-privacy-risk"]},"htmlUrl":"/controls/agents/records/risk-data-privacy-harms-to-individuals-510e65af.html","id":"risk:data-privacy-harms-to-individuals","title":"Privacy harms: distortion, stigmatization, unwarranted restriction","type":"risk","url":"/controls/assets/agent_record-risk-data-privacy-harms-to-individuals-510e65af.a90bd60a89f14912.json"},{"attributes":{"category":"privacy","domain":["Data Protection & Privacy","Compliance, Audit & Assurance"],"inherent_rating":"high","taxonomy":["nist-privacy-risk","enterprise-risk"]},"htmlUrl":"/controls/agents/records/risk-data-privacy-program-noncompliance-ec6178fa.html","id":"risk:data-privacy-program-noncompliance","title":"Privacy-program non-compliance (GDPR, CCPA, state laws)","type":"risk","url":"/controls/assets/agent_record-risk-data-privacy-program-noncompliance-ec6178fa.8ac644b99c17e190.json"},{"attributes":{"category":"privacy","domain":["Data Protection & Privacy"],"inherent_rating":"medium","taxonomy":["nist-privacy-risk"]},"htmlUrl":"/controls/agents/records/risk-data-reidentification-inference-d4b31f45.html","id":"risk:data-reidentification-inference","title":"Re-identification and unanticipated revelation from data","type":"risk","url":"/controls/assets/agent_record-risk-data-reidentification-inference-d4b31f45.96234ac6cb51ec7e.json"},{"attributes":{"category":"privacy","domain":["Data Protection & Privacy","Asset Management & Inventory"],"inherent_rating":"medium","taxonomy":["iso-27005-threat","iso-27005-vulnerability","nist-800-30-threat-event"]},"htmlUrl":"/controls/agents/records/risk-data-residual-media-disposal-92de3d1d.html","id":"risk:data-residual-media-disposal","title":"Residual data on improperly disposed or re-used media","type":"risk","url":"/controls/assets/agent_record-risk-data-residual-media-disposal-92de3d1d.3531f5ea0ca2c91c.json"},{"attributes":{"category":"privacy","domain":["Data Protection & Privacy","Compliance, Audit & Assurance"],"inherent_rating":"medium","taxonomy":["nist-privacy-risk","enterprise-risk"]},"htmlUrl":"/controls/agents/records/risk-data-retention-noncompliance-ec7b8dbc.html","id":"risk:data-retention-noncompliance","title":"Unlawful retention or premature deletion of records","type":"risk","url":"/controls/assets/agent_record-risk-data-retention-noncompliance-ec7b8dbc.192a2e5416ed7744.json"},{"attributes":{"category":"privacy","domain":["Data Protection & Privacy"],"inherent_rating":"medium","taxonomy":["nist-privacy-risk","nist-ai-rmf-risk"]},"htmlUrl":"/controls/agents/records/risk-data-surveillance-appropriation-18ad67e7.html","id":"risk:data-surveillance-appropriation","title":"Excessive surveillance, appropriation and induced disclosure","type":"risk","url":"/controls/assets/agent_record-risk-data-surveillance-appropriation-18ad67e7.0187550a58d80c71.json"},{"attributes":{"category":"privacy","domain":["Data Protection & Privacy","Awareness & Training"],"inherent_rating":"medium","taxonomy":["nist-privacy-risk"]},"htmlUrl":"/controls/agents/records/risk-data-transparency-notice-dark-patterns-9326fdf0.html","id":"risk:data-transparency-notice-dark-patterns","title":"Inadequate transparency, notice and deceptive privacy communications","type":"risk","url":"/controls/assets/agent_record-risk-data-transparency-notice-dark-patterns-9326fdf0.58dc7c7970f30305.json"},{"attributes":{"category":"esg","domain":["Business Continuity & Disaster Recovery","Physical & Environmental Security","Third-Party / Supply-Chain Risk"],"inherent_rating":"high","taxonomy":["enterprise-risk","coso-erm-risk"]},"htmlUrl":"/controls/agents/records/risk-esg-climate-physical-210261c0.html","id":"risk:esg-climate-physical","title":"Physical climate risk to facilities and supply chains","type":"risk","url":"/controls/assets/agent_record-risk-esg-climate-physical-210261c0.749c877734ff84db.json"},{"attributes":{"category":"esg","domain":["Risk Assessment & Management","Governance, Policy & Oversight"],"inherent_rating":"medium","taxonomy":["enterprise-risk","coso-erm-risk"]},"htmlUrl":"/controls/agents/records/risk-esg-climate-transition-35e73915.html","id":"risk:esg-climate-transition","title":"Climate transition risk — carbon pricing and stranded assets","type":"risk","url":"/controls/assets/agent_record-risk-esg-climate-transition-35e73915.e93cd0078b6c9437.json"},{"attributes":{"category":"esg","domain":["Compliance, Audit & Assurance","Governance, Policy & Oversight"],"inherent_rating":"medium","taxonomy":["enterprise-risk","coso-erm-risk"]},"htmlUrl":"/controls/agents/records/risk-esg-greenwashing-disclosure-be236248.html","id":"risk:esg-greenwashing-disclosure","title":"ESG disclosure gaps and greenwashing","type":"risk","url":"/controls/assets/agent_record-risk-esg-greenwashing-disclosure-be236248.5d1bf0f813187181.json"},{"attributes":{"category":"esg","domain":["Third-Party / Supply-Chain Risk","Human Resources / Personnel Security","Compliance, Audit & Assurance"],"inherent_rating":"medium","taxonomy":["coso-erm-risk"]},"htmlUrl":"/controls/agents/records/risk-esg-social-human-rights-1dbeca21.html","id":"risk:esg-social-human-rights","title":"Social and human-rights failures in operations and supply chain","type":"risk","url":"/controls/assets/agent_record-risk-esg-social-human-rights-1dbeca21.b6f07fedd98b891c.json"},{"attributes":{"category":"financial_reporting","domain":["Financial Reporting Controls (SOX)"],"inherent_rating":"medium","taxonomy":["sox-rmm-assertion"]},"htmlUrl":"/controls/agents/records/risk-fin-accuracy-measurement-errors-fd727255.html","id":"risk:fin-accuracy-measurement-errors","title":"Measurement and calculation errors (accuracy)","type":"risk","url":"/controls/assets/agent_record-risk-fin-accuracy-measurement-errors-fd727255.51e7d2954feccc11.json"},{"attributes":{"category":"financial_reporting","domain":["Financial Reporting Controls (SOX)"],"inherent_rating":"high","taxonomy":["sox-rmm-assertion"]},"htmlUrl":"/controls/agents/records/risk-fin-completeness-understatement-4b9388d1.html","id":"risk:fin-completeness-understatement","title":"Understatement of liabilities/expenses (completeness)","type":"risk","url":"/controls/assets/agent_record-risk-fin-completeness-understatement-4b9388d1.3ec214c453fbdaae.json"},{"attributes":{"category":"compliance_regulatory","domain":["Compliance, Audit & Assurance","Risk Assessment & Management","Governance, Policy & Oversight"],"inherent_rating":"high","taxonomy":["enterprise-risk","basel-operational-risk","coso-erm-risk"]},"htmlUrl":"/controls/agents/records/risk-fin-crime-aml-sanctions-80b15201.html","id":"risk:fin-crime-aml-sanctions","title":"Money laundering, sanctions and financial-crime program failures","type":"risk","url":"/controls/assets/agent_record-risk-fin-crime-aml-sanctions-80b15201.dc8d8a143317f0f2.json"},{"attributes":{"category":"financial_reporting","domain":["Financial Reporting Controls (SOX)"],"inherent_rating":"medium","taxonomy":["sox-rmm-assertion"]},"htmlUrl":"/controls/agents/records/risk-fin-cutoff-period-errors-180e8bcf.html","id":"risk:fin-cutoff-period-errors","title":"Period cut-off errors","type":"risk","url":"/controls/assets/agent_record-risk-fin-cutoff-period-errors-180e8bcf.2bcfbf3ba6d2af8e.json"},{"attributes":{"category":"financial_reporting","domain":["Financial Reporting Controls (SOX)","Data Protection & Privacy","Compliance, Audit & Assurance"],"inherent_rating":"high","taxonomy":["enterprise-risk","coso-erm-risk"]},"htmlUrl":"/controls/agents/records/risk-fin-data-quality-reporting-integrity-276baaa6.html","id":"risk:fin-data-quality-reporting-integrity","title":"Data-quality and IPE integrity failures in reporting","type":"risk","url":"/controls/assets/agent_record-risk-fin-data-quality-reporting-integrity-276baaa6.fe9832fea46bb093.json"},{"attributes":{"category":"financial_reporting","domain":["Financial Reporting Controls (SOX)"],"inherent_rating":"high","taxonomy":["sox-rmm-assertion"]},"htmlUrl":"/controls/agents/records/risk-fin-existence-overstatement-0e009631.html","id":"risk:fin-existence-overstatement","title":"Overstatement of assets/revenue (existence & occurrence)","type":"risk","url":"/controls/assets/agent_record-risk-fin-existence-overstatement-0e009631.9406a8c79c1d375d.json"},{"attributes":{"category":"financial_reporting","domain":["Financial Reporting Controls (SOX)","Compliance, Audit & Assurance"],"inherent_rating":"high","taxonomy":["sox-rmm-assertion","coso-erm-risk"]},"htmlUrl":"/controls/agents/records/risk-fin-financial-statement-fraud-1dd35d5a.html","id":"risk:fin-financial-statement-fraud","title":"Financial-statement fraud and management override","type":"risk","url":"/controls/assets/agent_record-risk-fin-financial-statement-fraud-1dd35d5a.71eca9f5af5de08e.json"},{"attributes":{"category":"financial_reporting","domain":["Financial Reporting Controls (SOX)","Compliance, Audit & Assurance","Governance, Policy & Oversight"],"inherent_rating":"critical","taxonomy":["enterprise-risk","coso-erm-risk","sox-rmm-assertion"]},"htmlUrl":"/controls/agents/records/risk-fin-icfr-material-weakness-cdd66323.html","id":"risk:fin-icfr-material-weakness","title":"Ineffective ICFR / undisclosed material weakness","type":"risk","url":"/controls/assets/agent_record-risk-fin-icfr-material-weakness-cdd66323.791c14d77bb254e0.json"},{"attributes":{"category":"financial_reporting","domain":["Financial Reporting Controls (SOX)","Logging, Monitoring & Detection"],"inherent_rating":"high","taxonomy":["sox-rmm-assertion"]},"htmlUrl":"/controls/agents/records/risk-fin-journal-entry-management-override-b0c0ed68.html","id":"risk:fin-journal-entry-management-override","title":"Manual journal entries and management-override risk","type":"risk","url":"/controls/assets/agent_record-risk-fin-journal-entry-management-override-b0c0ed68.a0ae21c54c86caf7.json"},{"attributes":{"category":"financial_reporting","domain":["Financial Reporting Controls (SOX)","Compliance, Audit & Assurance"],"inherent_rating":"medium","taxonomy":["sox-rmm-assertion"]},"htmlUrl":"/controls/agents/records/risk-fin-presentation-disclosure-5c00107e.html","id":"risk:fin-presentation-disclosure","title":"Presentation and disclosure deficiencies","type":"risk","url":"/controls/assets/agent_record-risk-fin-presentation-disclosure-5c00107e.6a2e81d3495f9797.json"},{"attributes":{"category":"financial_reporting","domain":["Financial Reporting Controls (SOX)","Compliance, Audit & Assurance"],"inherent_rating":"high","taxonomy":["sox-rmm-assertion"]},"htmlUrl":"/controls/agents/records/risk-fin-revenue-recognition-misstatement-5e181e17.html","id":"risk:fin-revenue-recognition-misstatement","title":"Revenue-recognition misstatement (fictitious, mis-timed, mis-measured)","type":"risk","url":"/controls/assets/agent_record-risk-fin-revenue-recognition-misstatement-5e181e17.e99ac4b325794f78.json"},{"attributes":{"category":"financial_reporting","domain":["Financial Reporting Controls (SOX)"],"inherent_rating":"medium","taxonomy":["sox-rmm-assertion"]},"htmlUrl":"/controls/agents/records/risk-fin-rights-obligations-relatedparty-60258f56.html","id":"risk:fin-rights-obligations-relatedparty","title":"Rights, obligations and related-party misstatement","type":"risk","url":"/controls/assets/agent_record-risk-fin-rights-obligations-relatedparty-60258f56.985235b7f6e040c0.json"},{"attributes":{"category":"financial_reporting","domain":["Financial Reporting Controls (SOX)","Access Control & Identity Management","Compliance, Audit & Assurance"],"inherent_rating":"high","taxonomy":["coso-erm-risk","sox-rmm-assertion"]},"htmlUrl":"/controls/agents/records/risk-fin-segregation-of-duties-eb7ee015.html","id":"risk:fin-segregation-of-duties","title":"Segregation-of-duties conflicts in financial processes","type":"risk","url":"/controls/assets/agent_record-risk-fin-segregation-of-duties-eb7ee015.15e31593894ec442.json"},{"attributes":{"category":"financial_reporting","domain":["Financial Reporting Controls (SOX)"],"inherent_rating":"medium","taxonomy":["sox-rmm-assertion"]},"htmlUrl":"/controls/agents/records/risk-fin-tax-provision-misstatement-55b9f382.html","id":"risk:fin-tax-provision-misstatement","title":"Tax provision, deferred-tax and uncertain-position misstatement","type":"risk","url":"/controls/assets/agent_record-risk-fin-tax-provision-misstatement-55b9f382.6e5342ceb4745411.json"},{"attributes":{"category":"financial_reporting","domain":["Financial Reporting Controls (SOX)"],"inherent_rating":"high","taxonomy":["sox-rmm-assertion"]},"htmlUrl":"/controls/agents/records/risk-fin-valuation-impairment-07037c02.html","id":"risk:fin-valuation-impairment","title":"Valuation and impairment misstatement","type":"risk","url":"/controls/assets/agent_record-risk-fin-valuation-impairment-07037c02.f6fe5e9a96a6f835.json"},{"attributes":{"category":"financial","domain":["Risk Assessment & Management"],"inherent_rating":"high","taxonomy":["enterprise-risk","coso-erm-risk"]},"htmlUrl":"/controls/agents/records/risk-financial-credit-market-risk-b9cbc5a3.html","id":"risk:financial-credit-market-risk","title":"Credit and market (rate/FX) risk","type":"risk","url":"/controls/assets/agent_record-risk-financial-credit-market-risk-b9cbc5a3.a680c1467d219d84.json"},{"attributes":{"category":"financial","domain":["Risk Assessment & Management"],"inherent_rating":"high","taxonomy":["enterprise-risk","coso-erm-risk"]},"htmlUrl":"/controls/agents/records/risk-financial-liquidity-capital-e0ac2d24.html","id":"risk:financial-liquidity-capital","title":"Liquidity, capital-structure and refinancing risk","type":"risk","url":"/controls/assets/agent_record-risk-financial-liquidity-capital-e0ac2d24.9b5eedafa0b7c78f.json"},{"attributes":{"category":"operational","domain":["Access Control & Identity Management","Risk Assessment & Management"],"inherent_rating":"high","taxonomy":["basel-operational-risk","coso-erm-risk"]},"htmlUrl":"/controls/agents/records/risk-fraud-external-c3ce412f.html","id":"risk:fraud-external","title":"External fraud — third-party theft, forgery, payment and account fraud","type":"risk","url":"/controls/assets/agent_record-risk-fraud-external-c3ce412f.52e3a797a9f19b74.json"},{"attributes":{"category":"operational","domain":["Governance, Policy & Oversight","Financial Reporting Controls (SOX)","Risk Assessment & Management"],"inherent_rating":"high","taxonomy":["basel-operational-risk","coso-erm-risk","sox-rmm-assertion"]},"htmlUrl":"/controls/agents/records/risk-fraud-internal-misappropriation-d235cd10.html","id":"risk:fraud-internal-misappropriation","title":"Internal fraud — asset misappropriation, embezzlement, forgery","type":"risk","url":"/controls/assets/agent_record-risk-fraud-internal-misappropriation-d235cd10.bb487f9245d5b14a.json"}],"schemaVersion":1,"total":172}