Sample context,ID,Area,Fictional risk scenario,Illustrative likelihood,Illustrative impact,Illustrative priority,Existing control status,Evidence to request,Proposed treatment,Proposed owner (fictional role),Treatment status,Target date,Residual risk status,Acceptance status
"Illustrative portfolio sample; not employer data",R-01,Access,"A departed user retains access because offboarding is not consistently recorded.",Possible,High,High,"Not verified","Authoritative leaver list; approved offboarding records; account-disable timestamps","Introduce an approved offboarding record and reconcile it with account status.",IT Manager,Proposed,"To be agreed","Not reassessed; treatment not implemented","No acceptance decision"
"Illustrative portfolio sample; not employer data",R-02,Recovery,"Recovery capability is uncertain because no recent restoration evidence is available.",Possible,High,High,"Not verified","Backup records; approved restore test procedure; results and exception log","Define an approved restore exercise and retain its results and corrective actions.",Infrastructure Owner,Proposed,"To be agreed","Not reassessed; treatment not implemented","No acceptance decision"
"Illustrative portfolio sample; not employer data",R-03,Supplier,"Supplier access persists without an identified business owner.",Possible,Moderate,Moderate,"Not verified","Supplier inventory; access records; owner approval; access expiry details","Assign an owner and review access need, scope and expiry.",Business Service Owner,Proposed,"To be agreed","Not reassessed; treatment not implemented","No acceptance decision"