Industry Vocabulary Reference

GRC, ESG & Enterprise Risk Management

Governance, risk, and compliance fields describe risk assessments, controls, vendor reviews, audits, incidents, and management reporting. ESG fields support recorded sustainability workflows.

Back to industry coverage library

This page shows selected examples and categories. Download the JSON for the complete vocabulary, including every field, permitted value, and policy pattern in this catalog.

How to use this reference

1. Start with the core file if you need the cross-industry governance baseline.
2. Choose an industry file for its workflow fields and permitted values.
3. Match the OTel attributes to the policy paths your rules use, then verify the recorded fields in a test session.

Catalog context

Connect each reported result to its scope, owner, and evidence. Keep risk estimates, measured outcomes, and unresolved findings distinct in executive reports.

Risk note: Framework mapping is not certification. Record which requirements were assessed and what evidence supports the conclusion; do not infer compliance from a vocabulary match.

Vocabulary file

• Download filename: 12_vertical_grc_esg_enterprise_risk.json
• Kind: vertical

OTel namespaces

Referenced standards

These references explain the catalog's context. A listed standard does not establish that a configured application meets its requirements.

• ISO 31000:2018, Risk Management Guidelines
• ISO 31010:2019, Risk Assessment Techniques
• COSO ERM 2017, Enterprise Risk Management, Integrating with Strategy and Performance
• COSO Internal Control, Integrated Framework (2013)
• ISO/IEC 42001:2023, Artificial Intelligence Management System (AIMS)
• ISO/IEC 23894:2023, Artificial Intelligence, Guidance on Risk Management
• ISO/IEC 38507:2022, Governance of AI by the Organisation
• NIST AI RMF 1.0, Artificial Intelligence Risk Management Framework (January 2023)
• NIST AI RMF Playbook, GOVERN, MAP, MEASURE, MANAGE function actions
• NIST AI 600-1, Generative AI Profile (July 2024)
• NIST SP 800-30 Rev 1, Guide for Conducting Risk Assessments
• EU AI Act (2024/1689), Full regulatory framework including Articles 9, 10, 11, 12, 13, 14, 17, 72, 73
• EU AI Act Article 9, Risk management system for high-risk AI
• EU AI Act Article 17, Quality management system for providers
• EU AI Act Article 72, Post-market monitoring by providers
• EU AI Act Article 73, Reporting of serious incidents
• EU AI Act Articles 53–55, GPAI model obligations and codes of practice
• EU AI Office, GPAI Model Code of Practice (Draft, March 2025)
• OECD Principles on AI (2019, updated 2024), International AI governance reference
• G7 Hiroshima AI Process (2023), Code of conduct for advanced AI
• Council of Europe AI Convention CETS 225 (2024)
• OCC 2011-12, Model Risk Management (banks)
• EBA Guidelines on Internal Governance (EBA/GL/2021/05), AI model governance
• DORA (EU) 2022/2554, Digital Operational Resilience Act, ICT risk management and AI
• Basel Committee BCBS 239, Principles for Effective Risk Data Aggregation
• IIA International Standards for the Professional Practice of Internal Auditing (2024 edition)
• IIA Global Technology Audit Guide (GTAG), Auditing Artificial Intelligence
• ISAE 3000 (Revised), Assurance Engagements Other than Audits or Reviews
• ISSB IFRS S1, General Requirements for Sustainability-related Financial Disclosures
• TCFD, Task Force on Climate-related Financial Disclosures (superseded by ISSB but foundational)
• GRI 101: Foundation 2021, GRI Standards for sustainability reporting
• SASB Standards, Sector-specific ESG metrics (now under ISSB)
• ISO 14001:2015, Environmental Management Systems
• UN Sustainable Development Goals (SDGs), Framework for ESG alignment reporting
• SBTi (Science Based Targets initiative), Corporate net-zero target validation
• CDP (Carbon Disclosure Project), Climate, water, and forests disclosure

Source references

• https://airc.nist.gov/airmf-resources/airmf/5-sec-core/ 
• https://www.iso.org/standard/81230.html 
• https://www.coso.org/guidance-on-erm 
• https://www.iso.org/standard/77304.html 
• https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32024R1689 
• https://www.ifrs.org/issued-standards/ifrs-sustainability-standards-navigator/ 
• https://www.theiia.org/en/standards/ 
• https://www.fsb-tcfd.org/ 

Subdomains

Implementation examples

• Enterprise Risk Assessment & Treatment: Risk Assessment Method. AI GRC agent selects risk assessment method based on risk category and materiality. Tier 4 critical AI systems require at minimum 'red_team_exercise' and 'threat_modeling_stride'. OPA policy enforces that any new high-risk AI deployment must have a completed risk assessment with a documented method before receiving production ATO. (Eu AI Act Art9: EU AI Act Article 9, High-risk AI risk management system requires documented risk identification and evaluation; the chosen risk assessment method must be recorded and reproducible)
• Enterprise Risk Assessment & Treatment: Risk Treatment Strategy. AI risk agent assigns a treatment strategy to each identified risk. OPA policy blocks 'accept_retain' treatment for any AI risk rated above the board-approved risk appetite threshold without explicit Risk Committee or CRO HITL authorisation. (Eu AI Act Art9: Article 9 requires assessment and management of risks for high-risk AI. The organization's risk policy assigns approval authority for accepting remaining risks.)
• Enterprise Risk Assessment & Treatment: Risk Appetite Status. AI risk monitoring agent continuously recalculates risk scores. 'Exceeds_tolerance' status on any material risk triggers immediate CIRO/CRO HITL notification and initiates the board escalation workflow. AI agent cannot autonomously resolve an 'exceeds_tolerance' status, only the Risk Committee can. (Coso Erm 2017: COSO ERM 2017 Principle 6, Board defines risk oversight and appetite; 'exceeds_tolerance' requires board notification)
• Enterprise Risk Assessment & Treatment: Compliance Action Status. AI compliance agent tracks all open remediation actions against their deadlines. 'Overdue' items trigger management escalation. OPA policy enforces that 'escalated_to_regulator' and 'regulatory_breach_confirmed' status transitions require CCO and General Counsel HITL, AI cannot self-escalate to regulatory authorities. (Eu AI Act Art62: EU AI Act Article 73, Serious incident reporting: 'escalated_to_regulator' status for AI serious incidents must be filed without undue delay)

Control ideas

These patterns describe possible controls, not active rules. Confirm applicability, implement the control, and test its effect on the application.

Enforce before the action

Pass the request and your business action to this function. The core SDK checks policy before the action runs and again before its result is released. A deny or review decision means the action never runs.

import { Veriproof } from '@veriproof/sdk-core';
import type { GovernedResult, IndustryFact, JsonValue } from '@veriproof/sdk-core';

const veriproof = Veriproof.fromEnv();

export async function runProtectedAction<TInput extends JsonValue, TValue>(
  request: TInput,
  action: (input: TInput, signal: AbortSignal) => Promise<TValue>,
): Promise<GovernedResult<TValue, TInput>> {
  // Catalog values for this vertical. Replace them with facts from the current workflow.
  const industry: IndustryFact[] = [
    { attribute: "grc.risk.assessment_method", policyInput: "grc_risk_assessment_method", value: "qualitative" },
    { attribute: "grc.risk.treatment_strategy", policyInput: "grc_risk_treatment_strategy", value: "avoid" },
    { attribute: "grc.risk.appetite_status", policyInput: "grc_risk_appetite_status", value: "within_appetite" },
  ];

  // Policy runs before action() and again before the result is released.
  // A deny or review decision means action() never runs.
  return veriproof.govern(
    "grc.esg.enterprise.risk.evaluate",
    request,
    ({ input, signal }) => action(input, signal),
    { industry },
  );
}

• Replace the sample values with facts from the current workflow. Rules read them under input.snapshot.industry.
• Test both permitted and blocked actions. Confirm that a blocked action never reaches your business function.
• Only completed, completed_with_warning, and transformed results carry a released value.

For review decisions, follow the Human Review guide to configure continuation. Observe remains available when you need to record activity without enforcing a decision.

Set up the GRC, ESG & Enterprise Risk Management example. See the API reference for TypeScript, Python, or .NET.

Selected vocabulary categories

This page uses the vocabulary JSON distributed with the documentation. Check its version when comparing it with an installed SDK.

Download the vocabulary JSON for offline review or automated comparisons.

Use the SDK reference for configuration and supported APIs. Keep vocabulary selection separate from the compliance team's assessment of applicable requirements.