Industry Vocabulary Reference

GRC, ESG & Enterprise Risk Management

Comprehensive enumeration library for the GRC, ESG & Enterprise Risk Management vertical. This is the capstone vertical — it provides the governance, risk, and compliance vocabulary that applies to the agentic AI GRC portal itself, and to any organisation deploying agentic AI at enterprise scale. Covers: ISO 31000:2018 / COSO ERM 2017 risk assessment and treatment lifecycle, NIST AI RMF 1.0 implementation tiers and function mapping, ISO/IEC 42001:2023 AI management system requirements, AI governance maturity modelling, third-party AI vendor risk management (SR 11-7, EU AI Act supply chain), ESG programme governance and double materiality, internal audit and assurance for AI systems (IIA Standards, ISAE 3000), enterprise risk appetite and tolerance framework, incident and near-miss management, board and executive AI governance obligations, and the regulatory cross-reference matrix linking the core SDK enumerations to the major AI governance frameworks. Designed for use as OTel span attributes in an agentic AI SDK and as policy vocabulary in an OPA Rego GRC portal.

Back to industry coverage library

How to use this reference

1. Start with the core file if you need the cross-industry governance baseline.
2. Then move into the vertical file to see the regulated workflow vocabulary, policy surfaces, and implementation pressure unique to this market.
3. Use the OTel attributes and policy paths here as the common language across SDK instrumentation, governance review, and evidence export.

March 2026 deployment context

As of March 2026, agentic AI in GRC, ESG, and enterprise risk management is deployed across: automated risk assessment and risk register maintenance (ISO 31000 / COSO ERM), continuous control monitoring and automated evidence collection (NIST SP 800-53, SOX 404), AI-driven regulatory horizon scanning and obligation mapping, AI governance maturity assessment and gap analysis (ISO/IEC 42001, NIST AI RMF), third-party AI vendor risk evaluation and due diligence, AI model risk management under SR 11-7 (model inventory, validation, performance monitoring), ESG data collection, materiality assessment, and disclosure preparation (CSRD, ISSB, SEC Climate Rule), internal audit AI (AI-assisted audit planning, continuous transaction monitoring, anomaly detection), AI incident and near-miss reporting (EU AI Act Article 62, DORA), board-level AI governance reporting and dashboard generation, and enterprise AI programme governance (Chief AI Officer enablement, AI use case inventory under OMB M-24-10). ISO/IEC 42001:2023 is the emerging certification standard for AI management systems — analogous to ISO 27001 for information security — and is driving significant GRC platform investment in 2025–2026. The EU AI Act Article 9 risk management system requirement and Article 17 quality management system requirement are the most operationally demanding regulatory obligations for providers of high-risk AI, applying from August 2026.

Risk note: ISO/IEC 42001:2023 is the first certifiable AI Management System standard. It requires organisations to establish context, define AI policy, conduct AI risk assessments, implement controls from Annex A, and undergo third-party certification audits. Several EU member state regulators and the EU AI Office are signalling that ISO 42001 certification may satisfy (or substantially support) the EU AI Act Article 17 quality management system requirements for providers of high-risk AI. The EU AI Act Article 62 serious incident reporting obligation requires providers to report serious incidents (death, serious harm, fundamental rights violations) to market surveillance authorities without undue delay — AI GRC platforms must build automated incident classification and regulatory notification workflows. DORA Article 28 requires EU financial entities to maintain a register of all ICT service providers, including AI vendors — AI GRC portals are the natural home for this register. SR 11-7 model risk management guidance, while US banking-focused, has become the de facto global standard for AI model governance in financial services and is increasingly applied by non-financial regulators by analogy.

Loading Model

• Mirrored file: 12_vertical_grc_esg_enterprise_risk.json
• Kind: vertical

OTel Namespaces

Primary Standards

• ISO 31000:2018 — Risk Management Guidelines
• ISO 31010:2019 — Risk Assessment Techniques
• COSO ERM 2017 — Enterprise Risk Management — Integrating with Strategy and Performance
• COSO Internal Control — Integrated Framework (2013)
• ISO/IEC 42001:2023 — Artificial Intelligence Management System (AIMS)
• ISO/IEC 23894:2023 — Artificial Intelligence — Guidance on Risk Management
• ISO/IEC 38507:2022 — Governance of AI by the Organisation
• NIST AI RMF 1.0 — Artificial Intelligence Risk Management Framework (January 2023)
• NIST AI RMF Playbook — GOVERN, MAP, MEASURE, MANAGE function actions
• NIST AI 600-1 — Generative AI Profile (July 2024)
• NIST SP 800-30 Rev 1 — Guide for Conducting Risk Assessments
• EU AI Act (2024/1689) — Full regulatory framework including Articles 9, 10, 11, 12, 13, 14, 17, 61, 62
• EU AI Act Article 9 — Risk management system for high-risk AI
• EU AI Act Article 17 — Quality management system for providers
• EU AI Act Article 61 — Post-market monitoring by providers
• EU AI Act Article 62 — Reporting of serious incidents
• EU AI Act Articles 53–55 — GPAI model obligations and codes of practice
• EU AI Office — GPAI Model Code of Practice (Draft, March 2025)
• OECD Principles on AI (2019, updated 2024) — International AI governance reference
• G7 Hiroshima AI Process (2023) — Code of conduct for advanced AI
• Council of Europe AI Convention CETS 225 (2024)
• Federal Reserve SR 11-7 — Supervisory Guidance on Model Risk Management (2011, still current)
• OCC 2011-12 — Model Risk Management (banks)
• EBA Guidelines on Internal Governance (EBA/GL/2021/05) — AI model governance
• DORA (EU) 2022/2554 — Digital Operational Resilience Act — ICT risk management and AI
• Basel Committee BCBS 239 — Principles for Effective Risk Data Aggregation
• IIA International Standards for the Professional Practice of Internal Auditing (2024 edition)
• IIA Global Technology Audit Guide (GTAG) — Auditing Artificial Intelligence
• ISAE 3000 (Revised) — Assurance Engagements Other than Audits or Reviews
• ISSB IFRS S1 — General Requirements for Sustainability-related Financial Disclosures
• TCFD — Task Force on Climate-related Financial Disclosures (superseded by ISSB but foundational)
• GRI 101: Foundation 2021 — GRI Standards for sustainability reporting
• SASB Standards — Sector-specific ESG metrics (now under ISSB)
• ISO 14001:2015 — Environmental Management Systems
• UN Sustainable Development Goals (SDGs) — Framework for ESG alignment reporting
• SBTi (Science Based Targets initiative) — Corporate net-zero target validation
• CDP (Carbon Disclosure Project) — Climate, water, and forests disclosure

Source URLs

• https://airc.nist.gov/airmf-resources/airmf/5-sec-core/
• https://www.iso.org/standard/81230.html
• https://www.coso.org/guidance-on-erm
• https://www.iso.org/standard/77304.html
• https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32024R1689
• https://www.ifrs.org/issued-standards/ifrs-sustainability-standards-navigator/
• https://www.theiia.org/en/standards/
• https://www.fsb-tcfd.org/

Subdomains

Implementation examples

• Enterprise Risk Assessment & Treatment: Risk Assessment Method. AI GRC agent selects risk assessment method based on risk category and materiality. Tier 4 critical AI systems require at minimum 'red_team_exercise' and 'threat_modeling_stride'. OPA policy enforces that any new high-risk AI deployment must have a completed risk assessment with a documented method before receiving production ATO. (Eu AI Act Art9: EU AI Act Article 9 — High-risk AI risk management system requires documented risk identification and evaluation; the chosen risk assessment method must be recorded and reproducible)
• Enterprise Risk Assessment & Treatment: Risk Treatment Strategy. AI risk agent assigns a treatment strategy to each identified risk. OPA policy blocks 'accept_retain' treatment for any AI risk rated above the board-approved risk appetite threshold without explicit Risk Committee or CRO HITL authorisation. (Eu AI Act Art9: EU AI Act Article 9(3) — Risk management system must include residual risk evaluation; 'accept_retain' for any risk classified as high requires documented AO or Risk Committee approval)
• Enterprise Risk Assessment & Treatment: Risk Appetite Status. AI risk monitoring agent continuously recalculates risk scores. 'Exceeds_tolerance' status on any material risk triggers immediate CIRO/CRO HITL notification and initiates the board escalation workflow. AI agent cannot autonomously resolve an 'exceeds_tolerance' status — only the Risk Committee can. (Coso Erm 2017: COSO ERM 2017 Principle 6 — Board defines risk oversight and appetite; 'exceeds_tolerance' requires board notification)
• Enterprise Risk Assessment & Treatment: Compliance Action Status. AI compliance agent tracks all open remediation actions against their deadlines. 'Overdue' items trigger management escalation. OPA policy enforces that 'escalated_to_regulator' and 'regulatory_breach_confirmed' status transitions require CCO and General Counsel HITL — AI cannot self-escalate to regulatory authorities. (Eu AI Act Art62: EU AI Act Article 62 — Serious incident reporting: 'escalated_to_regulator' status for AI serious incidents must be filed without undue delay)

Illustrative policy patterns

package grc.ai_deployment_governance

blocking_assessment_outcomes := {
  "assessment_not_conducted",
  "assessment_in_progress",
  "unacceptable_impact_deployment_blocked"
}

high_risk_maturity_required := "level_3_managed"

deny[msg] {
  input.grc_ai_impact_assessment_outcome in blocking_assessment_outcomes
  msg := sprintf("ISO 42001 Annex A.5 / EU AI Act Art 9: AI system '%v' cannot be deployed — impact assessment outcome is '%v'. A completed assessment with acceptable outcome is required.", [input.ai_system_id, input.grc_ai_impact_assessment_outcome])
}

package grc.ai_incident_management

deny[msg] {
  input.previous_incident_severity == "serious_incident_eu_ai_act_art62"
  input.proposed_incident_severity != "serious_incident_eu_ai_act_art62"
  not input.cco_hitl_approved_downgrade == true
  msg := "EU AI Act Art 62: Downgrading a serious incident classification requires CCO approval. AI incident management agent cannot autonomously reclassify serious incidents to lower severity."
}

deny[msg] {
  input.grc_ai_incident_severity == "serious_incident_eu_ai_act_art62"
  not input.regulatory_notification_initiated == true
  input.hours_since_incident_detected > 14
  msg := sprintf("EU AI Act Art 62: Serious incident '%v' detected %v hours ago. Regulatory notification must be submitted within 15 days. CIRO and Legal must initiate notification immediately.", [input.incident_id, input.hours_since_incident_detected])

From enum to evidence

The same vocabulary should carry from instrumentation through review. The OTel attribute names here become emitted metadata, those attributes become policy inputs, and those same labels should still be intelligible when a reviewer opens the decision record later.

import { VeriproofClient, VeriproofSdkOptions, SessionMetadata } from '@veriproof/sdk-core';
import { RiskAssessmentMethod, RiskAssessmentMethodMeta, RiskTreatmentStrategy, RiskTreatmentStrategyMeta, RiskAppetiteStatus, RiskAppetiteStatusMeta } from '@veriproof/sdk-core/verticals/grc-esg-enterprise-risk';

const client = new VeriproofClient(
  VeriproofSdkOptions.createProduction({
    apiKey: process.env.VERIPROOF_API_KEY!,
    applicationId: 'grc-esg-enterprise-risk-production',
  }),
);

const session = client
  .startSession('grc-esg-enterprise-risk.review')
  .withSessionMetadata(SessionMetadata.forTransaction('txn-1001').withEnvironment('production'))
  .addStep('evaluate_workflow', { output: { status: 'completed' } })
  .withMetadata(RiskAssessmentMethodMeta.otelAttribute, RiskAssessmentMethod.qualitative)
  .withMetadata(RiskTreatmentStrategyMeta.otelAttribute, RiskTreatmentStrategy.avoid)
  .withMetadata(RiskAppetiteStatusMeta.otelAttribute, RiskAppetiteStatus.within_appetite)

await session.complete();

• SDK: emit the OTel attribute shown on this page during the decision workflow.
• Policy: reference the matching `opa_policy_path` in governance rules.
• Evidence: surface the same label and value in the portal and exported record so reviewers are not translating between systems.

For a step-by-step getting-started walkthrough specific to this vertical, open the GRC, ESG & Enterprise Risk Management SDK quick start. For the full core API reference, continue with TypeScript, Python, or .NET.

Highlighted Enum Categories

This reference page is rendered from the mirrored JSON file inside the docs app, not from a hand-written website model.

If you need the machine-readable asset for offline review, automation, or internal diffing, use the mirrored JSON download above.

Next: open the corresponding SDK reference under SDK documentation and then compare it with the public-site industry page to see how the same vocabulary is framed commercially.