{"version":"0.11.0","built_at":"2026-10-12T01:17:59.374Z","license":"CC BY 4.0 © Mike Reams","canonical":"https://catalog.mikereams.com","value_stream":{"id":"VS-190","name":"Risk-to-Control","industries":["cross-industry"],"description":"From identifying a risk or a new legal obligation to a control that is designed, operating, monitored, tested and independently audited, with every gap tracked to closure. It follows a single exposure through the three lines of defense rather than any one function's process.","outcome":"Each significant risk and obligation has an owned control that works, the evidence shows it, and open findings are closed.","trigger":"A risk assessment, a new or changed regulation, an incident, or an audit finding surfaces an exposure the enterprise has not yet addressed.","aliases":["Risk-to-Assurance","Obligation-to-Control","Governance Risk & Compliance","Three Lines of Defense"],"stages":[{"id":"VS-190.10","order":1,"name":"Identify Risk & Obligation","description":"Capture the risk or the requirement, rate its likelihood and impact on the shared scale, and record which laws, regulations or policies it touches.","capability_ids":["BC-130.20","BC-140.10","BC-130.10"]},{"id":"VS-190.20","order":2,"name":"Decide Response & Design Control","description":"Decide whether to avoid, reduce, transfer or accept the exposure within appetite, and design the control, policy or insurance that makes that choice real.","capability_ids":["BC-130.30","BC-130.50","BC-120.30"]},{"id":"VS-190.30","order":3,"name":"Embed & Operate","description":"Put the control into the processes and systems that run the work, assign its owner, and train and attest the people who perform it.","capability_ids":["BC-140.20","BC-210.50","BC-760.10"]},{"id":"VS-190.40","order":4,"name":"Monitor & Test","description":"Watch the indicators that show the risk is moving, and test on a schedule whether the control is designed well and operating as intended.","capability_ids":["BC-130.40","BC-140.40","BC-160.40"]},{"id":"VS-190.50","order":5,"name":"Audit Independently","description":"Plan audits where a failure would hurt most, examine the control to a consistent method, and give the board an evidence-based conclusion.","capability_ids":["BC-160.10","BC-160.20"]},{"id":"VS-190.60","order":6,"name":"Remediate & Report","description":"Track every finding to an owned action and a date, verify the fix, and report the residual position to leadership, the board and regulators.","capability_ids":["BC-160.30","BC-130.40","BC-140.50"]}]}}