Record, Assure and Report
Where the evidence lives, who vouches for it, and what the board sees. 5 components, chapter 18 of the book.
Open risk register
Eleven register fields per row; a detail record with inherent, expected and measured exposure, planned and actual cost, source of information, dependencies and follow-up; roll-up by declared tier from system to organization to enterprise; export and import in the published schema, with framework fields as validating extensions.
Source: NIST IR 8286 and schemas [9]
Assurance map and reliance
Every principal risk shows the assurance it receives by line and provider; reliance on another provider is assessed and documented before it is taken; the control object carries designer and assurer, and the two may not be the same person within twelve months.
Source: IIA standards 9.5 and statements [18]; Orange Book [4]
Explainability
Every finding, rating or alert records the rule, the data, the threshold and the version that produced it; every simulation records its seed; where an AI system contributed, its version and last test level are named.
Reporting
One page per principal risk for the governing body: appetite position, tolerance status, indicators with thresholds and trend, events of the period, actions with dates, assurance opinion and explainability note; risk shown with culture and performance, not alone.
Maturity
Each layer carries a current and a target profile and a tier from 1 to 4 on two dimensions, risk-informed and repeatable; the gap and plan are reported with the risks; tiers describe the organization, not the controls.