{
 "meta": {
  "title": "Northstar executive risk and assurance dashboard",
  "simulated": true,
  "label": "SIMULATED: fictional company, synthetic data; not client work or an assurance opinion.",
  "as_of": "2026-09-30",
  "generator": "scripts/build_dashboard_data.py",
  "methodology": "docs/dashboard-methodology.md"
 },
 "kpis": [
  {
   "id": "K01",
   "label": "Open audit findings",
   "value": 12,
   "unit": "findings",
   "definition": "Findings from the Project 1 ITGC audit that are not closed by retest and not formally risk-accepted.",
   "calculation": "count(findings where status not in {'Closed (retested)','Risk accepted'})",
   "source_file": "data/analysis/findings.csv",
   "inclusion_exclusion": "Includes inconclusive F-13 and partially remediated findings. Excludes 2 closed or accepted. Project 1 only; vendor issues and framework gaps are counted separately.",
   "as_of": "2026-09-30",
   "case_study": "/projects/itgc-audit",
   "note": "",
   "simulated": true
  },
  {
   "id": "K02H",
   "label": "Open High findings",
   "value": 5,
   "unit": "findings",
   "definition": "Open Project 1 findings rated High.",
   "calculation": "count(open findings where severity = 'High')",
   "source_file": "data/analysis/findings.csv",
   "inclusion_exclusion": "Same inclusion as K01.",
   "as_of": "2026-09-30",
   "case_study": "/projects/itgc-audit",
   "note": "",
   "simulated": true
  },
  {
   "id": "K02M",
   "label": "Open Medium findings",
   "value": 7,
   "unit": "findings",
   "definition": "Open Project 1 findings rated Medium.",
   "calculation": "count(open findings where severity = 'Medium')",
   "source_file": "data/analysis/findings.csv",
   "inclusion_exclusion": "Same inclusion as K01.",
   "as_of": "2026-09-30",
   "case_study": "/projects/itgc-audit",
   "note": "",
   "simulated": true
  },
  {
   "id": "K02L",
   "label": "Open Low findings",
   "value": 0,
   "unit": "findings",
   "definition": "Open Project 1 findings rated Low.",
   "calculation": "count(open findings where severity = 'Low')",
   "source_file": "data/analysis/findings.csv",
   "inclusion_exclusion": "Same inclusion as K01.",
   "as_of": "2026-09-30",
   "case_study": "/projects/itgc-audit",
   "note": "",
   "simulated": true
  },
  {
   "id": "K03",
   "label": "Overdue remediation items",
   "value": 6,
   "unit": "items",
   "definition": "Remediation actions (Project 1) plus vendor remediation issues (Project 3) past their due date and not validated complete.",
   "calculation": "P1: count(actions where target_date < as_of and not (Completed and retest Pass)); P3: count(issues where overdue = Yes and status != Closed)",
   "source_file": "data/analysis/remediation_actions.csv; projects/03-third-party-risk/remediation-and-monitoring-tracker.csv",
   "inclusion_exclusion": "P1 contributes 1, P3 contributes 5. A management-reported completion that failed retest still counts as overdue.",
   "as_of": "2026-09-30",
   "case_study": "/projects/third-party-risk",
   "note": "",
   "simulated": true
  },
  {
   "id": "K04",
   "label": "Controls tested not operating effectively",
   "value": 12,
   "unit": "tests",
   "definition": "Project 1 control tests concluded 'Not operating effectively' out of 16 tests.",
   "calculation": "count(control_tests where conclusion starts with 'Not operating effectively')",
   "source_file": "data/analysis/control_tests.csv",
   "inclusion_exclusion": "Counts tests, not controls. 18 of 33 controls were not tested (see audit program). Conclusions are limited to the stated populations.",
   "as_of": "2026-09-30",
   "case_study": "/projects/itgc-audit",
   "note": "Tested controls are a risk-based selection, not a random sample, so this is not a rate for the whole control environment.",
   "simulated": true
  },
  {
   "id": "K05",
   "label": "Vendors with High residual risk",
   "value": 2,
   "unit": "vendors",
   "definition": "Assessed vendors whose residual risk after considering the evidence is High.",
   "calculation": "count(vendor_risk_register where residual_risk = 'High')",
   "source_file": "projects/03-third-party-risk/vendor-risk-register.csv",
   "inclusion_exclusion": "Only the 3 vendors assessed in Project 3; the other vendors in the inventory were not assessed.",
   "as_of": "2026-09-30",
   "case_study": "/projects/third-party-risk",
   "note": "",
   "simulated": true
  },
  {
   "id": "K06",
   "label": "AI use cases approved to proceed (unconditionally)",
   "value": 0,
   "unit": "use cases",
   "definition": "AI use cases with an unconditional approval decision.",
   "calculation": "count(ai_use_case_inventory where decision starts with 'Approved')",
   "source_file": "projects/04-ai-governance/ai-use-case-inventory.csv",
   "inclusion_exclusion": "Of 2 use cases: 1 Conditionally approved (limited pilot); 1 Not approved: must not proceed",
   "as_of": "2026-09-30",
   "case_study": "/projects/ai-governance",
   "note": "",
   "simulated": true
  },
  {
   "id": "K07",
   "label": "AI approval gates evidenced",
   "value": 0,
   "unit": "of 16 gates",
   "definition": "Approval gates for AI use cases with closing evidence on file.",
   "calculation": "count(gates where status = Done) over count(gates)",
   "source_file": "projects/04-ai-governance/ai-approval-gates.csv",
   "inclusion_exclusion": "Vendor-linked gates read their status from the Project 3 tracker.",
   "as_of": "2026-09-30",
   "case_study": "/projects/ai-governance",
   "note": "",
   "simulated": true
  },
  {
   "id": "K08",
   "label": "Audit-readiness gaps identified",
   "value": 54,
   "unit": "gaps",
   "definition": "Gaps found when 32 unified controls were assessed against the paraphrased framework requirements and Project 1 results.",
   "calculation": "count(audit-readiness-gap-assessment rows)",
   "source_file": "projects/02-unified-controls/audit-readiness-gap-assessment.csv",
   "inclusion_exclusion": "Gap types include missing evidence, operating failures, design weaknesses, mapping uncertainty and 'Not applicable' items.",
   "as_of": "2026-09-30",
   "case_study": "/projects/control-framework",
   "note": "",
   "simulated": true
  },
  {
   "id": "K09",
   "label": "Actionable gaps (excluding Not applicable)",
   "value": 50,
   "unit": "gaps",
   "definition": "Gaps that need action, excluding rows recorded as not applicable.",
   "calculation": "count(gaps where gap_type != 'Not applicable')",
   "source_file": "projects/02-unified-controls/audit-readiness-gap-assessment.csv",
   "inclusion_exclusion": "4 'Not applicable' rows excluded.",
   "as_of": "2026-09-30",
   "case_study": "/projects/control-framework",
   "note": "",
   "simulated": true
  },
  {
   "id": "K10",
   "label": "AI evidence review: exception recall (held-out, assisted mode)",
   "value": 0.93,
   "unit": "ratio",
   "definition": "Share of the 43 labelled exceptions in the held-out set that the rules-plus-mock-model pipeline flagged as exceptions.",
   "calculation": "TP / (TP + FN) from evaluation.json, held-out set of 108 cases",
   "source_file": "projects/05-ai-evidence-review/evaluation.json",
   "inclusion_exclusion": "95% interval 0.814-0.976. The 'model' is a heuristic mock, labels are author judgement, and no human review has been performed.",
   "as_of": "2026-09-30",
   "case_study": "/projects/ai-audit-analytics",
   "note": "Illustrative only; not evidence that AI improves audit quality.",
   "simulated": true
  },
  {
   "id": "K11",
   "label": "Enterprise risks needing executive acceptance (recorded residual >= 15)",
   "value": 0,
   "unit": "risks",
   "definition": "Enterprise risks whose recorded residual score meets the fictional executive-acceptance threshold.",
   "calculation": "count(risks where residual_score >= 15)",
   "source_file": "data/raw-synthetic/risks.csv",
   "inclusion_exclusion": "Residual scores are the pre-audit values recorded in the risk register. They were NOT re-rated after the audit results; see the heatmap note.",
   "as_of": "2026-09-30",
   "case_study": "/dashboard",
   "note": "",
   "simulated": true
  }
 ],
 "charts": {
  "C1": {
   "id": "C1",
   "title": "Findings by severity and status",
   "kind": "stacked-bar",
   "columns": [
    "Severity",
    "Open",
    "Closed or accepted",
    "Total"
   ],
   "rows": [
    [
     "High",
     5,
     1,
     6
    ],
    [
     "Medium",
     7,
     0,
     7
    ],
    [
     "Low",
     0,
     1,
     1
    ]
   ],
   "source_file": "data/analysis/findings.csv",
   "definition": "Project 1 findings by severity, split into open and closed/accepted.",
   "note": "",
   "simulated": true
  },
  "C2": {
   "id": "C2",
   "title": "Open findings by time to target date",
   "kind": "stacked-bar",
   "columns": [
    "Time to target date",
    "High",
    "Medium",
    "Low"
   ],
   "rows": [
    [
     "Due within 30 days",
     0,
     0,
     0
    ],
    [
     "Due in 31-60 days",
     5,
     0,
     0
    ],
    [
     "Due in 61-90 days",
     0,
     7,
     0
    ],
    [
     "Due in more than 90 days",
     0,
     0,
     0
    ]
   ],
   "source_file": "data/analysis/findings.csv",
   "definition": "Open findings grouped by days from the as-of date to the target remediation date.",
   "note": "All findings share one final-report date (2026-09-18), so finding age is the same for each; time to target date is shown instead.",
   "simulated": true
  },
  "C3": {
   "id": "C3",
   "title": "Open findings by control domain",
   "kind": "bar",
   "columns": [
    "Domain",
    "High",
    "Medium",
    "Low",
    "Total"
   ],
   "rows": [
    [
     "Change management",
     1,
     2,
     0,
     3
    ],
    [
     "IT operations",
     1,
     2,
     0,
     3
    ],
    [
     "Identity and access",
     2,
     2,
     0,
     4
    ],
    [
     "Logging and monitoring",
     0,
     1,
     0,
     1
    ],
    [
     "Privileged access",
     1,
     0,
     0,
     1
    ]
   ],
   "source_file": "data/analysis/findings.csv; data/raw-synthetic/control_library.csv",
   "definition": "Domain taken from the control cited in each finding's criteria reference.",
   "note": "",
   "simulated": true
  },
  "C4": {
   "id": "C4",
   "title": "Control test outcomes",
   "kind": "bar",
   "columns": [
    "Outcome",
    "Tests"
   ],
   "rows": [
    [
     "Effective with exceptions within tolerance",
     3
    ],
    [
     "Not operating effectively",
     12
    ],
    [
     "Inconclusive",
     1
    ]
   ],
   "source_file": "data/analysis/control_tests.csv",
   "definition": "Project 1 test conclusions. No test concluded fully effective with zero exceptions.",
   "note": "4 tests also noted a design deficiency.",
   "simulated": true
  },
  "C5": {
   "id": "C5",
   "title": "Project 1 remediation actions by validated state",
   "kind": "bar",
   "columns": [
    "State",
    "Actions"
   ],
   "rows": [
    [
     "Not started",
     11
    ],
    [
     "In progress",
     2
    ],
    [
     "Complete and retest passed",
     2
    ],
    [
     "Reported complete, retest failed",
     1
    ]
   ],
   "source_file": "data/analysis/remediation_actions.csv",
   "definition": "Management-reported status combined with the audit retest result.",
   "note": "'Reported complete, retest failed' is not counted as done.",
   "simulated": true
  },
  "C6": {
   "id": "C6",
   "title": "Open vendor issues by age and severity",
   "kind": "stacked-bar",
   "columns": [
    "Age since opened",
    "High",
    "Medium",
    "Low"
   ],
   "rows": [
    [
     "0-14 days",
     11,
     2,
     0
    ],
    [
     "15-30 days",
     0,
     0,
     0
    ],
    [
     "31+ days",
     2,
     1,
     2
    ]
   ],
   "source_file": "projects/03-third-party-risk/remediation-and-monitoring-tracker.csv",
   "definition": "Open or in-progress Project 3 vendor issues; age = as-of date minus opened date.",
   "note": "",
   "simulated": true
  },
  "C7": {
   "id": "C7",
   "title": "Vendor inherent vs residual risk",
   "kind": "paired",
   "columns": [
    "Vendor",
    "Tier",
    "Inherent",
    "Residual",
    "Movement"
   ],
   "rows": [
    [
     "Stratwick Managed Hosting Inc.",
     "Tier 1",
     "High",
     "High",
     "Same"
    ],
    [
     "Pinebrook Print and Mail Ltd.",
     "Tier 3",
     "Low",
     "Medium",
     "Up"
    ],
    [
     "Lumenvale AI Ltd.",
     "Tier 2",
     "Medium",
     "High",
     "Up"
    ]
   ],
   "source_file": "projects/03-third-party-risk/vendor-risk-register.csv",
   "definition": "Residual risk applies the documented step rule to the evidence status.",
   "note": "Only 3 vendors were assessed. Vendor V-02 moves up because of unanswered questionnaire items.",
   "simulated": true
  },
  "C8": {
   "id": "C8",
   "title": "AI use-case decisions and risk",
   "kind": "table",
   "columns": [
    "Use case",
    "Name",
    "Decision",
    "Inherent",
    "Residual as proposed",
    "Target after gates",
    "Gates evidenced"
   ],
   "rows": [
    [
     "AI-01",
     "Customer Support Response Assistant",
     "Conditionally approved (limited pilot)",
     "High",
     "High",
     "Medium",
     "0 of 8"
    ],
    [
     "AI-02",
     "Policy and Procedure Document Analyser",
     "Not approved: must not proceed",
     "High",
     "High",
     "Medium",
     "0 of 8"
    ]
   ],
   "source_file": "projects/04-ai-governance/ai-use-case-inventory.csv",
   "definition": "Committee decision, risk ratings and gate progress for the two proposed AI use cases.",
   "note": "",
   "simulated": true
  },
  "C9": {
   "id": "C9",
   "title": "Enterprise risk heatmap (recorded residual, pre-audit)",
   "kind": "heatmap",
   "columns": [
    "Likelihood",
    "Impact",
    "Risks",
    "Risk IDs"
   ],
   "rows": [
    [
     5,
     1,
     0,
     ""
    ],
    [
     5,
     2,
     0,
     ""
    ],
    [
     5,
     3,
     0,
     ""
    ],
    [
     5,
     4,
     0,
     ""
    ],
    [
     5,
     5,
     0,
     ""
    ],
    [
     4,
     1,
     0,
     ""
    ],
    [
     4,
     2,
     0,
     ""
    ],
    [
     4,
     3,
     0,
     ""
    ],
    [
     4,
     4,
     0,
     ""
    ],
    [
     4,
     5,
     0,
     ""
    ],
    [
     3,
     1,
     0,
     ""
    ],
    [
     3,
     2,
     0,
     ""
    ],
    [
     3,
     3,
     4,
     "R-03, R-07, R-08, R-11"
    ],
    [
     3,
     4,
     3,
     "R-01, R-04, R-09"
    ],
    [
     3,
     5,
     0,
     ""
    ],
    [
     2,
     1,
     0,
     ""
    ],
    [
     2,
     2,
     0,
     ""
    ],
    [
     2,
     3,
     4,
     "R-05, R-12, R-13, R-14"
    ],
    [
     2,
     4,
     3,
     "R-02, R-06, R-10"
    ],
    [
     2,
     5,
     0,
     ""
    ],
    [
     1,
     1,
     0,
     ""
    ],
    [
     1,
     2,
     0,
     ""
    ],
    [
     1,
     3,
     0,
     ""
    ],
    [
     1,
     4,
     0,
     ""
    ],
    [
     1,
     5,
     0,
     ""
    ]
   ],
   "source_file": "data/raw-synthetic/risks.csv",
   "definition": "Count of the 14 enterprise risks at each recorded residual likelihood and impact (5 x 5).",
   "note": "These are the scores recorded before the audit. They have not been re-rated; the table on the page shows open audit findings against each risk as a signal for management to re-rate.",
   "simulated": true
  },
  "C10": {
   "id": "C10",
   "title": "Enterprise risks and open audit findings",
   "kind": "table",
   "columns": [
    "Risk",
    "Title",
    "Recorded residual",
    "Open P1 findings",
    "Of which High"
   ],
   "rows": [
    [
     "R-01",
     "Inappropriate or unremoved user access",
     12,
     4,
     2
    ],
    [
     "R-02",
     "Misuse of privileged access",
     8,
     1,
     1
    ],
    [
     "R-03",
     "Unauthorised or untested production change",
     9,
     3,
     1
    ],
    [
     "R-04",
     "Data loss or unrecoverable systems",
     12,
     3,
     1
    ],
    [
     "R-05",
     "Security events not detected or acted on",
     6,
     1,
     0
    ],
    [
     "R-06",
     "Critical vendor failure",
     8,
     0,
     0
    ],
    [
     "R-07",
     "Vendor data exposure",
     9,
     0,
     0
    ],
    [
     "R-08",
     "Incorrect AI-generated customer response",
     9,
     0,
     0
    ],
    [
     "R-09",
     "Sensitive data exposed through an AI tool",
     12,
     0,
     0
    ],
    [
     "R-10",
     "Payment card data compromise",
     8,
     0,
     0
    ],
    [
     "R-11",
     "Unremediated vulnerabilities",
     9,
     0,
     0
    ],
    [
     "R-12",
     "Privacy breach or non-compliant retention",
     6,
     0,
     0
    ],
    [
     "R-13",
     "Insecure software development",
     6,
     0,
     0
    ],
    [
     "R-14",
     "Delayed incident response and notification",
     6,
     0,
     0
    ]
   ],
   "source_file": "data/raw-synthetic/risks.csv; data/analysis/findings.csv",
   "definition": "Open findings linked to each risk through the control cited.",
   "note": "",
   "simulated": true
  },
  "C11": {
   "id": "C11",
   "title": "Audit-readiness gaps by type and roadmap phase",
   "kind": "stacked-bar",
   "columns": [
    "Gap type",
    "By day 30",
    "By day 60",
    "By day 90",
    "Total"
   ],
   "rows": [
    [
     "Design weakness",
     3,
     2,
     2,
     7
    ],
    [
     "Mapping uncertainty",
     0,
     3,
     6,
     9
    ],
    [
     "Missing control",
     1,
     1,
     3,
     5
    ],
    [
     "Missing evidence",
     1,
     5,
     12,
     18
    ],
    [
     "Not applicable",
     0,
     0,
     4,
     4
    ],
    [
     "Operating failure",
     5,
     5,
     1,
     11
    ]
   ],
   "source_file": "projects/02-unified-controls/audit-readiness-gap-assessment.csv",
   "definition": "Phase = the 30/60/90-day roadmap slot each gap is scheduled in.",
   "note": "",
   "simulated": true
  },
  "C12": {
   "id": "C12",
   "title": "AI evidence review variants (held-out 108 cases)",
   "kind": "table",
   "columns": [
    "Variant",
    "Precision",
    "Recall",
    "F1",
    "False-positive rate",
    "Abstention rate"
   ],
   "rows": [
    [
     "Rules only",
     0.94,
     0.7,
     0.8,
     0.057,
     0.33
    ],
    [
     "Mock text-only",
     0.95,
     0.95,
     0.95,
     0.057,
     0.08
    ],
    [
     "Assisted",
     0.95,
     0.93,
     0.94,
     0.057,
     0.19
    ]
   ],
   "source_file": "projects/05-ai-evidence-review/evaluation.json",
   "definition": "Held-out evaluation of three review variants.",
   "note": "Mock model, author-labelled synthetic cases, no human review. Recall confidence intervals for rules-only and assisted overlap.",
   "simulated": true
  }
 },
 "records": {
  "findings": [
   {
    "id": "F-01",
    "project": "P1",
    "title": "Terminated employees retained active access to in-scope systems",
    "severity": "High",
    "status": "Partially remediated",
    "open": true,
    "domain": "Identity and access",
    "control_id": "NS-IAM-02",
    "risk_id": "R-01",
    "due": "2026-11-17",
    "days_to_due": 48,
    "retest": "Retested 2026-09-28: partially remediated"
   },
   {
    "id": "F-02",
    "project": "P1",
    "title": "Administrator access granted without documented approval",
    "severity": "High",
    "status": "Remediation in progress",
    "open": true,
    "domain": "Privileged access",
    "control_id": "NS-PAM-01",
    "risk_id": "R-02",
    "due": "2026-11-17",
    "days_to_due": 48,
    "retest": "Not yet due"
   },
   {
    "id": "F-03",
    "project": "P1",
    "title": "Quarterly user access reviews were late, incomplete, not independent or ineffective",
    "severity": "High",
    "status": "Open",
    "open": true,
    "domain": "Identity and access",
    "control_id": "NS-IAM-04",
    "risk_id": "R-01",
    "due": "2026-11-17",
    "days_to_due": 48,
    "retest": "Not yet due"
   },
   {
    "id": "F-04",
    "project": "P1",
    "title": "Service accounts without a valid owner",
    "severity": "Medium",
    "status": "Open",
    "open": true,
    "domain": "Identity and access",
    "control_id": "NS-IAM-05",
    "risk_id": "R-01",
    "due": "2026-12-17",
    "days_to_due": 78,
    "retest": "Not yet due"
   },
   {
    "id": "F-05",
    "project": "P1",
    "title": "Multi-factor authentication not enabled on some human accounts, including an administrator",
    "severity": "High",
    "status": "Closed (retested)",
    "open": false,
    "domain": "Identity and access",
    "control_id": "NS-IAM-07",
    "risk_id": "R-01",
    "due": "2026-11-17",
    "days_to_due": 48,
    "retest": "Retested 2026-09-28: remediated"
   },
   {
    "id": "F-06",
    "project": "P1",
    "title": "Dormant and role-change access not removed",
    "severity": "Medium",
    "status": "Remediation in progress",
    "open": true,
    "domain": "Identity and access",
    "control_id": "NS-IAM-06",
    "risk_id": "R-01",
    "due": "2026-12-17",
    "days_to_due": 78,
    "retest": "Dormant accounts retested 2026-09-28: remediated; mover access not yet due"
   },
   {
    "id": "F-07",
    "project": "P1",
    "title": "Some access was granted before approval, or without an approval record",
    "severity": "Low",
    "status": "Risk accepted",
    "open": false,
    "domain": "Identity and access",
    "control_id": "NS-IAM-01",
    "risk_id": "R-01",
    "due": "2027-01-16",
    "days_to_due": 108,
    "retest": "Not applicable (risk accepted)"
   },
   {
    "id": "F-08",
    "project": "P1",
    "title": "Developers deployed their own changes to production",
    "severity": "High",
    "status": "Open",
    "open": true,
    "domain": "Change management",
    "control_id": "NS-CHG-03",
    "risk_id": "R-03",
    "due": "2026-11-17",
    "days_to_due": 48,
    "retest": "Not yet due"
   },
   {
    "id": "F-09",
    "project": "P1",
    "title": "Normal changes lacked test evidence, independent approval or prior approval",
    "severity": "Medium",
    "status": "Open",
    "open": true,
    "domain": "Change management",
    "control_id": "NS-CHG-01",
    "risk_id": "R-03",
    "due": "2026-12-17",
    "days_to_due": 78,
    "retest": "Not yet due"
   },
   {
    "id": "F-10",
    "project": "P1",
    "title": "Emergency changes approved retrospectively after the 2-business-day limit",
    "severity": "Medium",
    "status": "Open",
    "open": true,
    "domain": "Change management",
    "control_id": "NS-CHG-04",
    "risk_id": "R-03",
    "due": "2026-12-17",
    "days_to_due": 78,
    "retest": "Not yet due"
   },
   {
    "id": "F-11",
    "project": "P1",
    "title": "Failed backups of the Payments API were not re-run",
    "severity": "Medium",
    "status": "Open",
    "open": true,
    "domain": "IT operations",
    "control_id": "NS-OPS-01",
    "risk_id": "R-04",
    "due": "2026-12-17",
    "days_to_due": 78,
    "retest": "Not yet due"
   },
   {
    "id": "F-12",
    "project": "P1",
    "title": "Restoration tests were not evidenced or not successful, and the control has no minimum frequency",
    "severity": "Medium",
    "status": "Open",
    "open": true,
    "domain": "IT operations",
    "control_id": "NS-OPS-02",
    "risk_id": "R-04",
    "due": "2026-12-17",
    "days_to_due": 78,
    "retest": "Not yet due"
   },
   {
    "id": "F-13",
    "project": "P1",
    "title": "No restoration test recorded for the Core Ledger or Data Warehouse (inconclusive pending confirmation)",
    "severity": "High",
    "status": "Inconclusive: awaiting management confirmation",
    "open": true,
    "domain": "IT operations",
    "control_id": "NS-OPS-02",
    "risk_id": "R-04",
    "due": "2026-11-17",
    "days_to_due": 48,
    "retest": "Not yet due"
   },
   {
    "id": "F-14",
    "project": "P1",
    "title": "Weekly security alert reviews were missing, late, duplicated or lacked escalation",
    "severity": "Medium",
    "status": "Open",
    "open": true,
    "domain": "Logging and monitoring",
    "control_id": "NS-LOG-02",
    "risk_id": "R-05",
    "due": "2026-12-17",
    "days_to_due": 78,
    "retest": "Not yet due"
   }
  ],
  "actions": [
   {
    "id": "F-01/A1",
    "project": "P1",
    "finding_id": "F-01",
    "severity": "High",
    "state": "Reported complete, retest failed",
    "due": "2026-09-25",
    "overdue": true,
    "days_overdue": 5
   },
   {
    "id": "F-01/A2",
    "project": "P1",
    "finding_id": "F-01",
    "severity": "High",
    "state": "In progress",
    "due": "2026-11-17",
    "overdue": false,
    "days_overdue": 0
   },
   {
    "id": "F-02/A1",
    "project": "P1",
    "finding_id": "F-02",
    "severity": "High",
    "state": "Not started",
    "due": "2026-11-17",
    "overdue": false,
    "days_overdue": 0
   },
   {
    "id": "F-03/A1",
    "project": "P1",
    "finding_id": "F-03",
    "severity": "High",
    "state": "Not started",
    "due": "2026-11-17",
    "overdue": false,
    "days_overdue": 0
   },
   {
    "id": "F-04/A1",
    "project": "P1",
    "finding_id": "F-04",
    "severity": "Medium",
    "state": "Not started",
    "due": "2026-12-17",
    "overdue": false,
    "days_overdue": 0
   },
   {
    "id": "F-05/A1",
    "project": "P1",
    "finding_id": "F-05",
    "severity": "High",
    "state": "Complete and retest passed",
    "due": "2026-09-25",
    "overdue": false,
    "days_overdue": 0
   },
   {
    "id": "F-06/A1",
    "project": "P1",
    "finding_id": "F-06",
    "severity": "Medium",
    "state": "Complete and retest passed",
    "due": "2026-09-25",
    "overdue": false,
    "days_overdue": 0
   },
   {
    "id": "F-06/A2",
    "project": "P1",
    "finding_id": "F-06",
    "severity": "Medium",
    "state": "In progress",
    "due": "2026-12-17",
    "overdue": false,
    "days_overdue": 0
   },
   {
    "id": "F-07/A1",
    "project": "P1",
    "finding_id": "F-07",
    "severity": "Low",
    "state": "Not started",
    "due": "2027-01-16",
    "overdue": false,
    "days_overdue": 0
   },
   {
    "id": "F-08/A1",
    "project": "P1",
    "finding_id": "F-08",
    "severity": "High",
    "state": "Not started",
    "due": "2026-11-17",
    "overdue": false,
    "days_overdue": 0
   },
   {
    "id": "F-09/A1",
    "project": "P1",
    "finding_id": "F-09",
    "severity": "Medium",
    "state": "Not started",
    "due": "2026-12-17",
    "overdue": false,
    "days_overdue": 0
   },
   {
    "id": "F-10/A1",
    "project": "P1",
    "finding_id": "F-10",
    "severity": "Medium",
    "state": "Not started",
    "due": "2026-12-17",
    "overdue": false,
    "days_overdue": 0
   },
   {
    "id": "F-11/A1",
    "project": "P1",
    "finding_id": "F-11",
    "severity": "Medium",
    "state": "Not started",
    "due": "2026-12-17",
    "overdue": false,
    "days_overdue": 0
   },
   {
    "id": "F-12/A1",
    "project": "P1",
    "finding_id": "F-12",
    "severity": "Medium",
    "state": "Not started",
    "due": "2026-12-17",
    "overdue": false,
    "days_overdue": 0
   },
   {
    "id": "F-13/A1",
    "project": "P1",
    "finding_id": "F-13",
    "severity": "High",
    "state": "Not started",
    "due": "2026-11-17",
    "overdue": false,
    "days_overdue": 0
   },
   {
    "id": "F-14/A1",
    "project": "P1",
    "finding_id": "F-14",
    "severity": "Medium",
    "state": "Not started",
    "due": "2026-12-17",
    "overdue": false,
    "days_overdue": 0
   }
  ],
  "tests": [
   {
    "id": "T-01",
    "project": "P1",
    "control_id": "NS-IAM-01",
    "domain": "Identity and access",
    "population": 408,
    "exceptions": 5,
    "conclusion": "Operating effectively with exceptions (within tolerance)",
    "outcome": "Effective with exceptions within tolerance",
    "design_deficiency": false
   },
   {
    "id": "T-02",
    "project": "P1",
    "control_id": "NS-IAM-02",
    "domain": "Identity and access",
    "population": 35,
    "exceptions": 8,
    "conclusion": "Not operating effectively",
    "outcome": "Not operating effectively",
    "design_deficiency": false
   },
   {
    "id": "T-03",
    "project": "P1",
    "control_id": "NS-IAM-03",
    "domain": "Identity and access",
    "population": 13,
    "exceptions": 2,
    "conclusion": "Not operating effectively",
    "outcome": "Not operating effectively",
    "design_deficiency": false
   },
   {
    "id": "T-04",
    "project": "P1",
    "control_id": "NS-IAM-04",
    "domain": "Identity and access",
    "population": 10,
    "exceptions": 8,
    "conclusion": "Not operating effectively; design deficiency noted",
    "outcome": "Not operating effectively",
    "design_deficiency": true
   },
   {
    "id": "T-05",
    "project": "P1",
    "control_id": "NS-IAM-05",
    "domain": "Identity and access",
    "population": 14,
    "exceptions": 4,
    "conclusion": "Not operating effectively; design deficiency noted",
    "outcome": "Not operating effectively",
    "design_deficiency": true
   },
   {
    "id": "T-06",
    "project": "P1",
    "control_id": "NS-IAM-06",
    "domain": "Identity and access",
    "population": 396,
    "exceptions": 4,
    "conclusion": "Operating effectively with exceptions (within tolerance)",
    "outcome": "Effective with exceptions within tolerance",
    "design_deficiency": false
   },
   {
    "id": "T-07",
    "project": "P1",
    "control_id": "NS-IAM-07",
    "domain": "Identity and access",
    "population": 413,
    "exceptions": 3,
    "conclusion": "Not operating effectively",
    "outcome": "Not operating effectively",
    "design_deficiency": false
   },
   {
    "id": "T-08",
    "project": "P1",
    "control_id": "NS-PAM-01",
    "domain": "Privileged access",
    "population": 19,
    "exceptions": 2,
    "conclusion": "Not operating effectively",
    "outcome": "Not operating effectively",
    "design_deficiency": false
   },
   {
    "id": "T-09",
    "project": "P1",
    "control_id": "NS-CHG-01",
    "domain": "Change management",
    "population": 77,
    "exceptions": 5,
    "conclusion": "Not operating effectively",
    "outcome": "Not operating effectively",
    "design_deficiency": false
   },
   {
    "id": "T-10",
    "project": "P1",
    "control_id": "NS-CHG-02",
    "domain": "Change management",
    "population": 77,
    "exceptions": 5,
    "conclusion": "Not operating effectively",
    "outcome": "Not operating effectively",
    "design_deficiency": false
   },
   {
    "id": "T-11",
    "project": "P1",
    "control_id": "NS-CHG-03",
    "domain": "Change management",
    "population": 91,
    "exceptions": 4,
    "conclusion": "Not operating effectively",
    "outcome": "Not operating effectively",
    "design_deficiency": false
   },
   {
    "id": "T-12",
    "project": "P1",
    "control_id": "NS-CHG-04",
    "domain": "Change management",
    "population": 14,
    "exceptions": 3,
    "conclusion": "Not operating effectively",
    "outcome": "Not operating effectively",
    "design_deficiency": false
   },
   {
    "id": "T-13",
    "project": "P1",
    "control_id": "NS-OPS-01",
    "domain": "IT operations",
    "population": 727,
    "exceptions": 5,
    "conclusion": "Operating effectively with exceptions (within tolerance)",
    "outcome": "Effective with exceptions within tolerance",
    "design_deficiency": false
   },
   {
    "id": "T-14",
    "project": "P1",
    "control_id": "NS-OPS-02",
    "domain": "IT operations",
    "population": 8,
    "exceptions": 3,
    "conclusion": "Inconclusive; design deficiency noted",
    "outcome": "Inconclusive",
    "design_deficiency": true
   },
   {
    "id": "T-15",
    "project": "P1",
    "control_id": "NS-OPS-02",
    "domain": "IT operations",
    "population": 5,
    "exceptions": 2,
    "conclusion": "Not operating effectively",
    "outcome": "Not operating effectively",
    "design_deficiency": false
   },
   {
    "id": "T-16",
    "project": "P1",
    "control_id": "NS-LOG-02",
    "domain": "Logging and monitoring",
    "population": 25,
    "exceptions": 8,
    "conclusion": "Not operating effectively; design deficiency noted",
    "outcome": "Not operating effectively",
    "design_deficiency": true
   }
  ],
  "vendor_issues": [
   {
    "id": "TPR-001",
    "project": "P3",
    "vendor_id": "V-01",
    "severity": "High",
    "status": "Open",
    "open": true,
    "overdue": false,
    "age_days": 13,
    "overdue_days": 0,
    "due": "2026-11-01"
   },
   {
    "id": "TPR-002",
    "project": "P3",
    "vendor_id": "V-01",
    "severity": "High",
    "status": "In progress",
    "open": true,
    "overdue": false,
    "age_days": 13,
    "overdue_days": 0,
    "due": "2026-11-01"
   },
   {
    "id": "TPR-003",
    "project": "P3",
    "vendor_id": "V-01",
    "severity": "High",
    "status": "In progress",
    "open": true,
    "overdue": false,
    "age_days": 13,
    "overdue_days": 0,
    "due": "2026-11-01"
   },
   {
    "id": "TPR-004",
    "project": "P3",
    "vendor_id": "V-01",
    "severity": "High",
    "status": "Open",
    "open": true,
    "overdue": false,
    "age_days": 13,
    "overdue_days": 0,
    "due": "2026-11-01"
   },
   {
    "id": "TPR-005",
    "project": "P3",
    "vendor_id": "V-01",
    "severity": "High",
    "status": "Open",
    "open": true,
    "overdue": false,
    "age_days": 13,
    "overdue_days": 0,
    "due": "2026-11-01"
   },
   {
    "id": "TPR-006",
    "project": "P3",
    "vendor_id": "V-01",
    "severity": "High",
    "status": "Closed",
    "open": false,
    "overdue": false,
    "age_days": 8,
    "overdue_days": 0,
    "due": "2026-11-01"
   },
   {
    "id": "TPR-007",
    "project": "P3",
    "vendor_id": "V-02",
    "severity": "Low",
    "status": "Open",
    "open": true,
    "overdue": true,
    "age_days": 44,
    "overdue_days": 23,
    "due": "2026-09-07"
   },
   {
    "id": "TPR-008",
    "project": "P3",
    "vendor_id": "V-02",
    "severity": "Medium",
    "status": "Open",
    "open": true,
    "overdue": false,
    "age_days": 13,
    "overdue_days": 0,
    "due": "2026-12-01"
   },
   {
    "id": "TPR-009",
    "project": "P3",
    "vendor_id": "V-02",
    "severity": "Medium",
    "status": "Open",
    "open": true,
    "overdue": true,
    "age_days": 44,
    "overdue_days": 23,
    "due": "2026-09-07"
   },
   {
    "id": "TPR-010",
    "project": "P3",
    "vendor_id": "V-02",
    "severity": "Low",
    "status": "Closed",
    "open": false,
    "overdue": false,
    "age_days": 40,
    "overdue_days": 0,
    "due": "2026-09-07"
   },
   {
    "id": "TPR-011",
    "project": "P3",
    "vendor_id": "V-02",
    "severity": "Medium",
    "status": "Open",
    "open": true,
    "overdue": false,
    "age_days": 13,
    "overdue_days": 0,
    "due": "2026-12-01"
   },
   {
    "id": "TPR-012",
    "project": "P3",
    "vendor_id": "V-03",
    "severity": "High",
    "status": "Open",
    "open": true,
    "overdue": false,
    "age_days": 13,
    "overdue_days": 0,
    "due": "2026-11-01"
   },
   {
    "id": "TPR-013",
    "project": "P3",
    "vendor_id": "V-03",
    "severity": "High",
    "status": "Open",
    "open": true,
    "overdue": false,
    "age_days": 13,
    "overdue_days": 0,
    "due": "2026-11-01"
   },
   {
    "id": "TPR-014",
    "project": "P3",
    "vendor_id": "V-03",
    "severity": "High",
    "status": "Open",
    "open": true,
    "overdue": true,
    "age_days": 44,
    "overdue_days": 23,
    "due": "2026-09-07"
   },
   {
    "id": "TPR-015",
    "project": "P3",
    "vendor_id": "V-03",
    "severity": "High",
    "status": "Open",
    "open": true,
    "overdue": false,
    "age_days": 13,
    "overdue_days": 0,
    "due": "2026-11-01"
   },
   {
    "id": "TPR-016",
    "project": "P3",
    "vendor_id": "V-03",
    "severity": "High",
    "status": "Open",
    "open": true,
    "overdue": true,
    "age_days": 44,
    "overdue_days": 23,
    "due": "2026-09-07"
   },
   {
    "id": "TPR-017",
    "project": "P3",
    "vendor_id": "V-03",
    "severity": "Low",
    "status": "Open",
    "open": true,
    "overdue": true,
    "age_days": 44,
    "overdue_days": 23,
    "due": "2026-09-07"
   },
   {
    "id": "TPR-018",
    "project": "P3",
    "vendor_id": "V-03",
    "severity": "High",
    "status": "Open",
    "open": true,
    "overdue": false,
    "age_days": 13,
    "overdue_days": 0,
    "due": "2026-11-01"
   },
   {
    "id": "TPR-019",
    "project": "P3",
    "vendor_id": "V-03",
    "severity": "High",
    "status": "Open",
    "open": true,
    "overdue": false,
    "age_days": 13,
    "overdue_days": 0,
    "due": "2026-11-01"
   },
   {
    "id": "TPR-020",
    "project": "P3",
    "vendor_id": "V-03",
    "severity": "High",
    "status": "Open",
    "open": true,
    "overdue": false,
    "age_days": 13,
    "overdue_days": 0,
    "due": "2026-11-01"
   }
  ],
  "vendors": [
   {
    "id": "V-01",
    "project": "P3",
    "name": "Stratwick Managed Hosting Inc.",
    "tier": "Tier 1",
    "inherent": "High",
    "residual": "High",
    "decision": "Conditionally approve"
   },
   {
    "id": "V-02",
    "project": "P3",
    "name": "Pinebrook Print and Mail Ltd.",
    "tier": "Tier 3",
    "inherent": "Low",
    "residual": "Medium",
    "decision": "Conditionally approve"
   },
   {
    "id": "V-03",
    "project": "P3",
    "name": "Lumenvale AI Ltd.",
    "tier": "Tier 2",
    "inherent": "Medium",
    "residual": "High",
    "decision": "Restrict"
   }
  ],
  "ai_use_cases": [
   {
    "id": "AI-01",
    "project": "P4",
    "name": "Customer Support Response Assistant",
    "status": "Pilot gated",
    "decision": "Conditionally approved (limited pilot)",
    "inherent": "High",
    "residual_as_proposed": "High",
    "target_after_gates": "Medium",
    "gates_total": 8,
    "gates_done": 0
   },
   {
    "id": "AI-02",
    "project": "P4",
    "name": "Policy and Procedure Document Analyser",
    "status": "Not approved",
    "decision": "Not approved: must not proceed",
    "inherent": "High",
    "residual_as_proposed": "High",
    "target_after_gates": "Medium",
    "gates_total": 8,
    "gates_done": 0
   }
  ],
  "ai_gates": [
   {
    "id": "AI-01-G01",
    "project": "P4",
    "use_case_id": "AI-01",
    "status": "Blocked",
    "due": "2026-11-01"
   },
   {
    "id": "AI-01-G02",
    "project": "P4",
    "use_case_id": "AI-01",
    "status": "Blocked",
    "due": "2026-11-01"
   },
   {
    "id": "AI-01-G03",
    "project": "P4",
    "use_case_id": "AI-01",
    "status": "In progress",
    "due": "2026-11-15"
   },
   {
    "id": "AI-01-G04",
    "project": "P4",
    "use_case_id": "AI-01",
    "status": "Not started",
    "due": "2026-11-15"
   },
   {
    "id": "AI-01-G05",
    "project": "P4",
    "use_case_id": "AI-01",
    "status": "In progress",
    "due": "2026-11-15"
   },
   {
    "id": "AI-01-G06",
    "project": "P4",
    "use_case_id": "AI-01",
    "status": "Not started",
    "due": "2026-11-15"
   },
   {
    "id": "AI-01-G07",
    "project": "P4",
    "use_case_id": "AI-01",
    "status": "Not started",
    "due": "2026-11-22"
   },
   {
    "id": "AI-01-G08",
    "project": "P4",
    "use_case_id": "AI-01",
    "status": "Not started",
    "due": "2026-11-22"
   },
   {
    "id": "AI-02-G01",
    "project": "P4",
    "use_case_id": "AI-02",
    "status": "Blocked",
    "due": "2027-01-31"
   },
   {
    "id": "AI-02-G02",
    "project": "P4",
    "use_case_id": "AI-02",
    "status": "Not started",
    "due": "2027-01-31"
   },
   {
    "id": "AI-02-G03",
    "project": "P4",
    "use_case_id": "AI-02",
    "status": "Not started",
    "due": "2027-01-31"
   },
   {
    "id": "AI-02-G04",
    "project": "P4",
    "use_case_id": "AI-02",
    "status": "Not started",
    "due": "2027-01-31"
   },
   {
    "id": "AI-02-G05",
    "project": "P4",
    "use_case_id": "AI-02",
    "status": "Not started",
    "due": "2027-01-31"
   },
   {
    "id": "AI-02-G06",
    "project": "P4",
    "use_case_id": "AI-02",
    "status": "Not started",
    "due": "2027-02-28"
   },
   {
    "id": "AI-02-G07",
    "project": "P4",
    "use_case_id": "AI-02",
    "status": "Not started",
    "due": "2027-02-28"
   },
   {
    "id": "AI-02-G08",
    "project": "P4",
    "use_case_id": "AI-02",
    "status": "Not started",
    "due": "2027-02-28"
   }
  ],
  "risks": [
   {
    "id": "R-01",
    "title": "Inappropriate or unremoved user access",
    "inherent": 20,
    "residual": 12,
    "res_l": 3,
    "res_i": 4,
    "owner": "IT Security Manager",
    "status": "Open",
    "open_p1_findings": 4,
    "open_p1_high": 2,
    "exec_acceptance": false
   },
   {
    "id": "R-02",
    "title": "Misuse of privileged access",
    "inherent": 15,
    "residual": 8,
    "res_l": 2,
    "res_i": 4,
    "owner": "IT Security Manager",
    "status": "Open",
    "open_p1_findings": 1,
    "open_p1_high": 1,
    "exec_acceptance": false
   },
   {
    "id": "R-03",
    "title": "Unauthorised or untested production change",
    "inherent": 16,
    "residual": 9,
    "res_l": 3,
    "res_i": 3,
    "owner": "Change Manager",
    "status": "Open",
    "open_p1_findings": 3,
    "open_p1_high": 1,
    "exec_acceptance": false
   },
   {
    "id": "R-04",
    "title": "Data loss or unrecoverable systems",
    "inherent": 15,
    "residual": 12,
    "res_l": 3,
    "res_i": 4,
    "owner": "Head of IT Operations",
    "status": "Open",
    "open_p1_findings": 3,
    "open_p1_high": 1,
    "exec_acceptance": false
   },
   {
    "id": "R-05",
    "title": "Security events not detected or acted on",
    "inherent": 12,
    "residual": 6,
    "res_l": 2,
    "res_i": 3,
    "owner": "IT Security Manager",
    "status": "Open",
    "open_p1_findings": 1,
    "open_p1_high": 0,
    "exec_acceptance": false
   },
   {
    "id": "R-06",
    "title": "Critical vendor failure",
    "inherent": 15,
    "residual": 8,
    "res_l": 2,
    "res_i": 4,
    "owner": "Head of Procurement",
    "status": "Open",
    "open_p1_findings": 0,
    "open_p1_high": 0,
    "exec_acceptance": false
   },
   {
    "id": "R-07",
    "title": "Vendor data exposure",
    "inherent": 12,
    "residual": 9,
    "res_l": 3,
    "res_i": 3,
    "owner": "Head of Procurement",
    "status": "Open",
    "open_p1_findings": 0,
    "open_p1_high": 0,
    "exec_acceptance": false
   },
   {
    "id": "R-08",
    "title": "Incorrect AI-generated customer response",
    "inherent": 12,
    "residual": 9,
    "res_l": 3,
    "res_i": 3,
    "owner": "Head of Customer Support",
    "status": "Open",
    "open_p1_findings": 0,
    "open_p1_high": 0,
    "exec_acceptance": false
   },
   {
    "id": "R-09",
    "title": "Sensitive data exposed through an AI tool",
    "inherent": 15,
    "residual": 12,
    "res_l": 3,
    "res_i": 4,
    "owner": "AI Governance Committee",
    "status": "Open",
    "open_p1_findings": 0,
    "open_p1_high": 0,
    "exec_acceptance": false
   },
   {
    "id": "R-10",
    "title": "Payment card data compromise",
    "inherent": 10,
    "residual": 8,
    "res_l": 2,
    "res_i": 4,
    "owner": "Head of Payments Engineering",
    "status": "Open",
    "open_p1_findings": 0,
    "open_p1_high": 0,
    "exec_acceptance": false
   },
   {
    "id": "R-11",
    "title": "Unremediated vulnerabilities",
    "inherent": 16,
    "residual": 9,
    "res_l": 3,
    "res_i": 3,
    "owner": "Head of Platform Engineering",
    "status": "Open",
    "open_p1_findings": 0,
    "open_p1_high": 0,
    "exec_acceptance": false
   },
   {
    "id": "R-12",
    "title": "Privacy breach or non-compliant retention",
    "inherent": 12,
    "residual": 6,
    "res_l": 2,
    "res_i": 3,
    "owner": "Privacy Officer",
    "status": "Open",
    "open_p1_findings": 0,
    "open_p1_high": 0,
    "exec_acceptance": false
   },
   {
    "id": "R-13",
    "title": "Insecure software development",
    "inherent": 12,
    "residual": 6,
    "res_l": 2,
    "res_i": 3,
    "owner": "VP Engineering",
    "status": "Monitoring",
    "open_p1_findings": 0,
    "open_p1_high": 0,
    "exec_acceptance": false
   },
   {
    "id": "R-14",
    "title": "Delayed incident response and notification",
    "inherent": 12,
    "residual": 6,
    "res_l": 2,
    "res_i": 3,
    "owner": "IT Security Manager",
    "status": "Monitoring",
    "open_p1_findings": 0,
    "open_p1_high": 0,
    "exec_acceptance": false
   }
  ]
 },
 "roadmap": {
  "items_by_phase": {
   "By day 30": 10,
   "By day 60": 16,
   "By day 90": 28
  },
  "library_controls": 32
 },
 "reconciliation": {
  "findings_rows": 14,
  "tests_rows": 16,
  "actions_rows": 16,
  "issues_rows": 20,
  "vendors_rows": 3,
  "ai_use_cases_rows": 2,
  "gates_rows": 16,
  "gaps_rows": 54,
  "risks_rows": 14,
  "checks": {
   "severity_chart_total_equals_findings": true,
   "domain_chart_total_equals_open": true,
   "test_chart_total_equals_tests": true,
   "action_chart_total_equals_actions": true,
   "vendor_age_total_equals_open_issues": true,
   "gap_chart_total_equals_gaps": true,
   "heatmap_total_equals_risks": true,
   "due_chart_total_equals_open": true
  }
 }
}