Appendix B

The forty-seven components

Each component is the unit of adoption: a code, a name, a specification an auditor can test, and the source it came from. Type to filter by name, word or source key.

Code	Component	Layer	Sources
C0.1	Purpose and principles A written statement, approved by the governing body, that risk management exists to create and protect value. The risk management system is evaluated at least annually ag…	L0 Govern	[1]
C0.2	Governance and culture The governing body oversees risk and its oversight is recorded. Culture is defined, measured in eight aspects on a stated cycle, and reported on the same page as risk and…	L0 Govern	[2] [4] [6]
C0.3	Three lines and prohibitions Management owns risks and controls; independent functions oversee; internal audit assures; a governing body is named as accountable for all three. Three prohibitions are …	L0 Govern	[18]
C0.4	Govern first Governance is a function with outcomes of its own, each with a current and a target state: context, risk strategy, roles, policy, oversight, supply chain. Appetite and to…	L0 Govern	[23]
C0.5	Risk leadership Every decision informed by a risk analysis names its decision authority, who is accountable for the decision; the analyst is accountable for the analysis. Decision author…	L0 Govern	[11]
C1.1	Scope, context and criteria Scope, context and criteria are written and versioned before any assessment. Criteria state how likelihood is judged, how consequence is judged, how they are combined and…	L1 Frame	[1]
C1.2	Strategy linkage Three strategy risks are assessed and recorded at least annually: misalignment with mission and values, unweighed implications of the chosen strategy, failure of executio…	L1 Frame	[2]
C1.3	Appetite scale Appetite is set per risk category on a five-position scale: averse, minimal, cautious, open, eager. Each category carries an optimal position and an accepted position (th…	L1 Frame	[4]
C1.4	Layered appetite Three nested boundaries are stated: the risk universe; the risk universe boundary (the source's “tolerance boundary”), the most the organization could bear; appetite insi…	L1 Frame	[6]
C1.5	Appetite versus tolerance Appetite is a broad qualitative statement set by the governing body. Tolerance is a measurable range tied to at least one leading and one lagging indicator. Neither subst…	L1 Frame	[9]
C1.6	Tolerance per objective Each objective carries its own tolerance, set by the decision authority before alternatives are analyzed. Aggregated risk against an objective is reported as the likeliho…	L1 Frame	[11]
C1.7	Three tiers Every risk record declares its tier: organization (enterprise), mission or business process, or system. Roll-up from tier to tier normalizes records as it goes. A record …	L1 Frame	[9] [20]
C2.1	Source taxonomy and source by process matrix Every risk carries a node of a versioned, source-organized taxonomy with three levels and an “other” branch at each; branches are prioritized by summed exposure, not by c…	L2 Identify	[3]
C2.2	Validated risk statement The register row is a statement in four parts, condition, departure, asset, consequence against an objective; a statement missing a part or embedding its own solution is …	L2 Identify	[6] [11]
C2.3	Failure-mode decomposition Each process is decomposed into functions written as verb and noun, each function into its failure modes, effects and causes; controls in place are tagged as acting on th…	L2 Identify	[8]
C2.4	Horizon scanning A scanning routine with declared drivers, a stated cadence and a radar with a trail; each signal is classified by speed, slow risks to the register as scenarios, fast ris…	L2 Identify	[6]
C2.5	External vocabularies Identification consults four controlled lists, the thirty-three global risks on two horizons, the supervisors' vulnerabilities, the two hundred and eighty-one coded hazar…	L2 Identify	[9] [22] [24] [27]
C2.6	Opportunities Identification is run from the threat side, the opportunity side and both, with the technique and the side it finds recorded; a positive risk is a full register row with …	L2 Identify	[2] [6] [9]
C2.7	Component-level supply chain For every third party the component is also known: a software bill of materials with eleven minimum fields, a hardware bill with geography of manufacture, the chain of nt…	L2 Identify	[15]
C3.1	The scenario triplet Every analyzed risk is recorded as a scenario, a likelihood and a consequence, each with its uncertainty; likelihood is a probability, a frequency or a calibrated word, n…	L3 Analyze	[11]
C3.2	Honest scales Every label maps to a versioned numeric band; consequence is assessed per objective and the highest severity governs; every estimate carries a precision field; probabilit…	L3 Analyze	[12]
C3.3	Action Priority Severity, occurrence and detection are rated one to ten; priority is read from a table in which severity dominates; a severity of nine or ten requires action or a signed …	L3 Analyze	[8]
C3.4	Simulation that proves itself Every simulated result reports convergence with a standard error, the sampling scheme, a validation against a closed-form case, a heavy-tail check, a global sensitivity r…	L3 Analyze	[26]
C3.5	Composite indices Indicators are normalized to zero to ten; dimensions are aggregated geometrically so that a zero zeroes the score; a reliability index from missing and aged data is publi…	L3 Analyze	[7]
C3.6	Regulatory model discipline A model is legitimate only while named tests pass: backtesting with zones and a fallback, attribution per unit of accountability, outlier tests against a stated base; wha…	L3 Analyze	[5] [19]
C3.7	Integrated stress and reverse stress One scenario moves losses, income, capital or cash and liquidity together, year by year, under rules fixed in advance; an inventory records scenarios, owners and last run…	L3 Analyze	[25]
C3.8	Climate and physical scenarios Reference scenarios on a long and a short horizon; transition and physical variables kept apart, acute and chronic damages not summed; physical scenarios parameterized as…	L3 Analyze	[13] [24]
C3.9	Structural models Where failure logic can be drawn, fault and event trees with common-cause failure and human reliability; minimal cut sets listed; importance measures rank controls by con…	L3 Analyze	[11]
C4.1	Seven responses, named decider Every risk carries exactly one response from accept, avoid, mitigate, share, transfer, realize, share, enhance; a row with no response is invalid. Alternatives are compar…	L4 Respond	[2] [9] [20]
C4.2	Hierarchy of controls Every control carries its level (elimination, substitution, engineering, administrative, personal protection), a human-dependence flag and an expected decay profile; cont…	L4 Respond	[10]
C4.3	Prevention and detection Every control is tagged prevention (acts on the cause) or detection (acts on the mode); occurrence and detection ratings are revisited after any action with the previous …	L4 Respond	[8]
C4.4	Design gate No new product, process, system or material change goes live before a review asks whether its hazards can be eliminated or substituted rather than administered; the answe…	L4 Respond	[10] [17]
C4.5	Decision record Responses above a stated materiality are recorded in a selection report: alternatives, tolerance per objective, risk of each alternative, rationale, expected exposure, de…	L4 Respond	[11] [18]
C4.6	Proportionality In the tolerable region, treatment continues until the next step is grossly disproportionate to its benefit; the disproportion is argued in writing with the cost and bene…	L4 Respond	[26]
C4.7	AI controls Every AI system is mapped, measured and managed against the seven trustworthiness characteristics with a current and a target profile; each carries decision rights set by…	L4 Respond	[3] [21]
C5.1	Risk data discipline Every number that reaches a risk report is accurate and reconciled, complete across entities and risk types, timely including in a crisis, adaptable to unplanned question…	L5 Monitor	[17]
C5.2	Indicators Every indicator has a threshold; every breach and its escalation are traceable to a recipient and an action; leading indicators are reported apart from lagging ones, neve…	L5 Monitor	[17] [26]
C5.3	Events, near misses and root cause Losses and near misses enter one base with cause in a fixed taxonomy; barrier analysis names from the register the control that should have prevented and the one that sho…	L5 Monitor	[14] [17]
C5.4	Common incident schema One structured incident record compatible with the supervisory exchange format, four sections and three phases; loss base, cyber log and third-party incidents are views o…	L5 Monitor	[27]
C5.5	Calibration Estimates are confronted with outcomes: likelihood bands against event counts, detection ratings against escapes, simulated distributions against losses; scales and model…	L5 Monitor	[5] [12]
C5.6	Continuity A business impact analysis per process with maximum tolerable outage, recovery time and recovery point; the resource inherits the most demanding function's recovery time …	L5 Monitor	[9] [16]
C5.7	Lifecycle and triggers Every register object has a lifecycle state with continuous authorization and an explicit disposal step; substantial change triggers reassessment and reopens the design g…	L5 Monitor	[2] [7] [20] [24]
C6.1	Open risk register Eleven register fields per row; a detail record with inherent, expected and measured exposure, planned and actual cost, source of information, dependencies and follow-up;…	L6 Record, Assure and Report	[9]
C6.2	Assurance map and reliance Every principal risk shows the assurance it receives by line and provider; reliance on another provider is assessed and documented before it is taken; the control object …	L6 Record, Assure and Report	[4] [18]
C6.3	Explainability Every finding, rating or alert records the rule, the data, the threshold and the version that produced it; every simulation records its seed; where an AI system contribut…	L6 Record, Assure and Report	[12] [26]
C6.4	Reporting One page per principal risk for the governing body: appetite position, tolerance status, indicators with thresholds and trend, events of the period, actions with dates, a…	L6 Record, Assure and Report	[2] [4]
C6.5	Maturity Each layer carries a current and a target profile and a tier from 1 to 4 on two dimensions, risk-informed and repeatable; the gap and plan are reported with the risks; ti…	L6 Record, Assure and Report	[2] [23]

The same data as a file: catalog.json.