Risk register
Inherent risk is the position before ARC’s controls are credited. Residual is what a named reviewer concluded remains — ARC never computes it, because crediting a control automatically would mean grading our own homework.
2 recorded1 residual reviewed0 accepted
| Reference | Risk | Inherent | Residual | Treatment | Owner | Controls |
|---|---|---|---|---|---|---|
| RISK-AI-001 | An agent issues a refund outside policy | High 12 | Low 4 | mitigate | cfo@arctransformationgroup.com | ARC-AI-003 ARC-AI-004 |
| RISK-AI-002 | The audit log is truncated without detection | Moderate 10 | not reviewed | mitigate | secops@arctransformationgroup.com | ARC-AI-006 |