{"catalogRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","download":{"releaseId":"sha256:57c08c6c52a513441fbe47cf22eec1d7394e01eea00512fea01dea80b56f9e09","slug":"grc-enterprise-risk-assessment-treatment-cycle","url":"/controls/assets/agent_workflow-grc-enterprise-risk-assessment-treatment-cycle-2a22f4b7.26abae2254db0d2a.json"},"kind":"record","record":{"attributes":{"department":"operations","domain":"grc","lineOfDefense":"operate"},"canonicalUrl":"https://assureswarm.com/workflows/all/?w=grc-enterprise-risk-assessment-treatment-cycle","description":"Enterprise Risk Treatment Operations Cycle as a decision-aware workflow: it runs the documented risk methodology each cycle - identification and analysis of risks and opportunities, evaluation and prioritization against risk criteria, treatment selection and tracking for risks exceeding tolerance with residual re-evaluation, and risk-register and portfolio reporting to management and the board - triggering dynamic reassessment when internal or external change shifts the risk profile. This cycle has no anchor item of its own: the enterprise risk register it maintains IS the Risk item population, and the workflow instance is the cycle record and durable audit trail. In scope: entity-level and process-level risk across the enterprise, explicitly including cybersecurity, privacy, and financial-reporting risk alongside operational and strategic risk and opportunity. Out of scope: detailed control design and testing, which downstream control workflows own - a mitigate or share/transfer plan that creates or strengthens a control hands that work off to those workflows, which anchor on the affected Control items. This cycle has no upstream workflow feeding it; its starting inputs are the documented methodology, the consistent likelihood/impact scoring scales, the board-approved risk criteria and appetite/tolerance statements, and the risk-acceptance delegation matrix - all carried as Policy items - plus the existing control, insurance and transfer information (Control items and step documents) and the prior cycle's Risk register. Named deliverables: the maintained enterprise risk register (the Risk items), the prioritized risk heat-map dashboard, and the management and board portfolio report package.","details":{"canonicalUrl":"https://assureswarm.com/workflows/all/?w=grc-enterprise-risk-assessment-treatment-cycle","capabilities":[],"controls":["UC-RISK-06","UC-RISK-07","UC-RISK-08","UC-RISK-09","UC-RISK-10","UC-RISK-11"],"domains":["grc"],"lineOfDefense":"operate","mappingStatus":"mapped","releaseId":"sha256:57c08c6c52a513441fbe47cf22eec1d7394e01eea00512fea01dea80b56f9e09","roleIntegrity":{"activityCount":0,"ermPhases":[],"lineRoles":[],"serviceModes":[],"warnings":[]},"sourceTemplateId":"workflow-library:grc-enterprise-risk-assessment-treatment-cycle","standards":["iso-31000","coso-erm","nist-csf-2","nist-800-53"],"teams":["operations","risk-management"]},"id":"wf:G22","mapUrl":"https://assureswarm.com/controls/?v=1&node=wf%3AG22","slug":"grc-enterprise-risk-assessment-treatment-cycle","sourceIds":["coso-erm","coso-ic","iso-31000","nist-800-53","nist-csf-2","nydfs-500","soc2","sox"],"sourceUrl":null,"title":"Enterprise Risk Treatment Operations Cycle","type":"workflow"},"relationships":[{"expectedCatalogRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","id":"rel:01ce8ae1ab49976e0742f5ce7d0bf3b50631a0265d24712d5fbea9da3da2f2eb","properties":{},"sourceDetailPath":"/controls/data/v1/records/wf-g22-87bce2d6.json","sourceId":"wf:G22","targetDetailPath":"/controls/data/v1/records/uc-uc-risk-06-e9599494.json","targetId":"uc:UC-RISK-06","type":"operates"},{"expectedCatalogRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","id":"rel:57702ef5e30ad07f33e36fec45854fda67abedb1a4c657f08a11ef16ea7b7a6f","properties":{},"sourceDetailPath":"/controls/data/v1/records/wf-g22-87bce2d6.json","sourceId":"wf:G22","targetDetailPath":"/controls/data/v1/records/uc-uc-risk-11-3f5d23ea.json","targetId":"uc:UC-RISK-11","type":"operates"},{"expectedCatalogRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","id":"rel:9190c372e946c8a006341905f80ee84a71a9ed49295c6f66b4cd0743a2b71981","properties":{},"sourceDetailPath":"/controls/data/v1/records/wf-g22-87bce2d6.json","sourceId":"wf:G22","targetDetailPath":"/controls/data/v1/records/uc-uc-risk-09-06ffdff1.json","targetId":"uc:UC-RISK-09","type":"operates"},{"expectedCatalogRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","id":"rel:a0cfec379b936dd4a1cdba28e0e0f8e8f197f3e6f74d85de5cc26de6cd98e1c3","properties":{},"sourceDetailPath":"/controls/data/v1/records/wf-g22-87bce2d6.json","sourceId":"wf:G22","targetDetailPath":"/controls/data/v1/records/uc-uc-risk-10-6d44f690.json","targetId":"uc:UC-RISK-10","type":"operates"},{"expectedCatalogRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","id":"rel:bb351c3b24136aa98f03bea4acd4d268242071a75cb3f4c476abb5739aed57ed","properties":{},"sourceDetailPath":"/controls/data/v1/records/wf-g22-87bce2d6.json","sourceId":"wf:G22","targetDetailPath":"/controls/data/v1/records/uc-uc-risk-07-b86de728.json","targetId":"uc:UC-RISK-07","type":"operates"},{"expectedCatalogRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","id":"rel:cc1a7329e4d403890a2da42a07dd82ad51d7989bf88fe8dedf422a690071438b","properties":{},"sourceDetailPath":"/controls/data/v1/records/wf-g22-87bce2d6.json","sourceId":"wf:G22","targetDetailPath":"/controls/data/v1/records/uc-uc-risk-08-5f27bebc.json","targetId":"uc:UC-RISK-08","type":"operates"}],"schemaVersion":1}