Risk, Control and Test Traceability
Purpose: Trace every risk in the register to the control objectives that treat it and to the test cases that exercise those controls, and list the controls that have no test case yet.
Audience: Auditors, GRC, security engineering, vendor evaluation teams.
How to use: Start from a risk to find what to implement and what to test. Start from a control to see which risks it treats and which test pages hold its cases.
The tables are generated each time the site is built. They are read from the AI Risk to Control Mapping and from the "Control(s) Tested" field of each case in the Test Case Library. To change a link, edit the page that owns it; this page follows on the next build.
Risks to controls and tests
The number after each control is its count of test cases. The last column counts the distinct test cases across the risk's controls.
| Risk | Title | Controls (test cases) | Test cases |
|---|---|---|---|
| AI-R01 | Critical Infrastructure Information Exposure | AI-CTRL-002 (16); AI-CTRL-003 (6); AI-CTRL-010 (27); AI-CTRL-017 (31) | 78 |
| AI-R02 | Shadow AI and Ungoverned AI Usage | AI-CTRL-001 (33); AI-CTRL-010 (27); AI-CTRL-011 (18); AI-CTRL-012 (7); AI-CTRL-037 (10); AI-CTRL-044 (1) | 88 |
| AI-R03 | Sensitive Data Leakage Through Prompts and Uploads | AI-CTRL-002 (16); AI-CTRL-003 (6); AI-CTRL-010 (27); AI-CTRL-012 (7); AI-CTRL-013 (39); AI-CTRL-017 (31); AI-CTRL-021 (28) | 137 |
| AI-R04 | IDE-Based Source Code and Credential Exposure | AI-CTRL-004 (18) | 18 |
| AI-R05 | Prompt Injection Against Custom AI Applications | AI-CTRL-005 (52); AI-CTRL-019 (12); AI-CTRL-020 (13); AI-CTRL-021 (28); AI-CTRL-026 (5); AI-CTRL-033 (6); AI-CTRL-034 (36) | 140 |
| AI-R06 | AI Output Leakage and Oversharing | AI-CTRL-005 (52); AI-CTRL-016 (50); AI-CTRL-017 (31); AI-CTRL-018 (9); AI-CTRL-020 (13) | 150 |
| AI-R07 | AI Agent and Tool-Calling Abuse | AI-CTRL-006 (15); AI-CTRL-015 (44); AI-CTRL-016 (50); AI-CTRL-022 (18); AI-CTRL-023 (7); AI-CTRL-024 (15); AI-CTRL-025 (11); AI-CTRL-026 (5); AI-CTRL-027 (11); AI-CTRL-033 (6); AI-CTRL-034 (36); AI-CTRL-045 (3) | 194 |
| AI-R08 | AI Supply Chain and Model Integrity Risk | AI-CTRL-014 (24); AI-CTRL-016 (50); AI-CTRL-019 (12); AI-CTRL-024 (15); AI-CTRL-028 (18); AI-CTRL-029 (16); AI-CTRL-030 (16); AI-CTRL-031 (24); AI-CTRL-032 (27); AI-CTRL-033 (6) | 187 |
| AI-R09 | Lack of AI Auditability and Forensic Visibility | AI-CTRL-008 (22); AI-CTRL-009 (22); AI-CTRL-035 (39); AI-CTRL-038 (17); AI-CTRL-043 (1) | 95 |
| AI-R10 | Data Sovereignty and Third-Party Processing Risk | AI-CTRL-007 (14); AI-CTRL-013 (39); AI-CTRL-014 (24); AI-CTRL-032 (27); AI-CTRL-042 (1); AI-CTRL-043 (1) | 101 |
| AI-R11 | AI Cost Abuse and Resource Exhaustion | AI-CTRL-025 (11); AI-CTRL-036 (30) | 39 |
| AI-R12 | Unreliable or Harmful AI Output | AI-CTRL-039 (8); AI-CTRL-041 (3); AI-CTRL-042 (1); AI-CTRL-045 (3) | 14 |
| AI-R13 | AI Service Disruption and Dependency Failure | AI-CTRL-040 (13) | 13 |
| AI-R14 | Biased or Discriminatory AI Outcomes | AI-CTRL-033 (6); AI-CTRL-039 (8); AI-CTRL-041 (3); AI-CTRL-045 (3) | 19 |
| AI-R15 | Lack of Explainability and Decision Traceability | AI-CTRL-008 (22); AI-CTRL-038 (17); AI-CTRL-041 (3) | 41 |
| AI-R16 | Foundation Model Version Change and Non-Deterministic Behaviour | AI-CTRL-014 (24); AI-CTRL-031 (24); AI-CTRL-033 (6); AI-CTRL-034 (36); AI-CTRL-040 (13) | 100 |
| AI-R17 | Data Quality Degradation and Model Drift | AI-CTRL-017 (31); AI-CTRL-019 (12); AI-CTRL-034 (36) | 78 |
| AI-R18 | Model Overreach and Use Beyond Approved Purpose | AI-CTRL-011 (18); AI-CTRL-012 (7); AI-CTRL-037 (10); AI-CTRL-045 (3) | 38 |
| AI-R19 | Insufficient or Ineffective Human Oversight | AI-CTRL-012 (7); AI-CTRL-023 (7); AI-CTRL-044 (1); AI-CTRL-045 (3) | 17 |
| AI-R20 | Reputational Harm from AI Behaviour | AI-CTRL-034 (36); AI-CTRL-035 (39); AI-CTRL-039 (8) | 82 |
| AI-R21 | Agent Memory and State Persistence Poisoning | AI-CTRL-025 (11); AI-CTRL-026 (5); AI-CTRL-027 (11) | 26 |
| AI-R22 | Agent-Mediated Credential Discovery and Harvesting | AI-CTRL-004 (18); AI-CTRL-015 (44); AI-CTRL-016 (50); AI-CTRL-027 (11) | 116 |
| AI-R23 | Skill, Plugin and MCP Server Supply Chain Compromise | AI-CTRL-024 (15); AI-CTRL-031 (24) | 38 |
| AI-R24 | Tool Chain Manipulation and Injection | AI-CTRL-005 (52); AI-CTRL-020 (13); AI-CTRL-022 (18); AI-CTRL-024 (15) | 92 |
| AI-R25 | Multi-Agent Trust Boundary Violation | AI-CTRL-006 (15); AI-CTRL-015 (44); AI-CTRL-025 (11); AI-CTRL-027 (11) | 76 |
| AI-R26 | Reasoning Trace and Intermediate Output Exposure | AI-CTRL-008 (22); AI-CTRL-020 (13) | 35 |
| AI-R27 | Intellectual Property and Copyright Infringement | AI-CTRL-002 (16); AI-CTRL-003 (6); AI-CTRL-012 (7); AI-CTRL-013 (39); AI-CTRL-046 (4) | 70 |
| AI-R28 | Regulatory Non-Compliance from Unsupervised AI Decisions | AI-CTRL-012 (7); AI-CTRL-013 (39); AI-CTRL-037 (10); AI-CTRL-038 (17); AI-CTRL-042 (1); AI-CTRL-045 (3) | 77 |
Controls to risks and tests
Each test page is followed by the number of its cases that test the control.
| Control | Name | Risks treated | Test cases | Test pages |
|---|---|---|---|---|
| AI-CTRL-001 | AI Discovery | AI-R02 | 33 | D10 (2); D11 (1); D13 (1); L01 (1); L04 (12); L05 (11); L11 (1); L12 (1); L14 (2); L15 (1) |
| AI-CTRL-002 | Prompt Inspection | AI-R01; AI-R03; AI-R27 | 16 | D11 (3); L04 (4); L08 (9) |
| AI-CTRL-003 | File Upload Protection | AI-R01; AI-R03; AI-R27 | 6 | D10 (1); L04 (3); L08 (2) |
| AI-CTRL-004 | IDE AI Governance | AI-R04; AI-R22 | 18 | L04 (3); L05 (6); L06 (1); L07 (1); L08 (3); L09 (1); L14 (1); L16 (1); L17 (1) |
| AI-CTRL-005 | Runtime AI Security | AI-R05; AI-R06; AI-R24 | 52 | D10 (3); D11 (4); L05 (2); L06 (2); L07 (34); L08 (3); L11 (2); L14 (1); L16 (1) |
| AI-CTRL-006 | Agent Governance | AI-R07; AI-R25 | 15 | D09 (1); D10 (2); L04 (1); L06 (10); L17 (1) |
| AI-CTRL-007 | Data Sovereignty | AI-R10 | 14 | L03 (3); L08 (1); L10 (5); L15 (4); L16 (1) |
| AI-CTRL-008 | Auditability | AI-R09; AI-R15; AI-R26 | 22 | D09 (1); D10 (1); D12 (1); L02 (1); L05 (1); L06 (2); L08 (1); L09 (1); L10 (1); L11 (1); L12 (1); L13 (1); L14 (1); L15 (1); L17 (7) |
| AI-CTRL-009 | SOC Integration | AI-R09 | 22 | L06 (1); L07 (1); L09 (1); L14 (1); L17 (18) |
| AI-CTRL-010 | Policy Enforcement | AI-R01; AI-R02; AI-R03 | 27 | L02 (1); L04 (8); L05 (1); L08 (16); L12 (1) |
| AI-CTRL-011 | AI Use-Case Registry and Risk Tiering | AI-R02; AI-R18 | 18 | L01 (13); L03 (1); L05 (2); L12 (2) |
| AI-CTRL-012 | AI Policy, Roles and Acceptable Use | AI-R02; AI-R03; AI-R18; AI-R19; AI-R27; AI-R28 | 7 | L02 (6); L04 (1) |
| AI-CTRL-013 | Privacy and Regulatory Compliance | AI-R03; AI-R10; AI-R27; AI-R28 | 39 | D11 (4); D12 (2); L01 (2); L02 (1); L03 (21); L04 (1); L07 (1); L10 (3); L13 (3); L17 (1) |
| AI-CTRL-014 | Third-Party and Vendor AI Assurance | AI-R08; AI-R10; AI-R16 | 24 | D09 (1); D12 (1); D13 (1); L01 (1); L02 (1); L03 (2); L06 (2); L10 (1); L13 (1); L15 (1); L16 (12) |
| AI-CTRL-015 | Human and Agent Identity | AI-R07; AI-R22; AI-R25 | 44 | D09 (14); D10 (1); D11 (1); L04 (1); L06 (7); L09 (11); L12 (5); L13 (4) |
| AI-CTRL-016 | Least Privilege and Scoped Credentials | AI-R06; AI-R07; AI-R08; AI-R22 | 50 | D09 (6); D10 (2); D13 (1); L05 (1); L06 (6); L07 (1); L08 (2); L09 (15); L10 (1); L11 (1); L12 (5); L13 (5); L14 (3); L15 (1) |
| AI-CTRL-017 | Data Protection in AI Pipelines | AI-R01; AI-R03; AI-R06; AI-R17 | 31 | D08 (1); D10 (1); D11 (1); L03 (2); L05 (1); L06 (1); L08 (1); L10 (15); L11 (4); L13 (2); L14 (1); L15 (1) |
| AI-CTRL-018 | Retrieval Access Control | AI-R06 | 9 | L10 (3); L11 (6) |
| AI-CTRL-019 | Knowledge Base Integrity | AI-R05; AI-R08; AI-R17 | 12 | L07 (1); L10 (1); L11 (10) |
| AI-CTRL-020 | Output Handling | AI-R05; AI-R06; AI-R24; AI-R26 | 13 | D11 (1); L05 (7); L06 (2); L07 (1); L08 (2) |
| AI-CTRL-021 | Multimodal and Voice Input Security | AI-R03; AI-R05 | 28 | D11 (22); L04 (3); L07 (2); L08 (1) |
| AI-CTRL-022 | Deterministic Action Authorization | AI-R07; AI-R24 | 18 | D09 (1); D10 (6); L05 (1); L06 (8); L07 (1); L09 (1) |
| AI-CTRL-023 | Human Approval for Sensitive Actions | AI-R07; AI-R19 | 7 | D10 (2); L01 (1); L06 (2); L07 (1); L09 (1) |
| AI-CTRL-024 | Tool and MCP Server Governance | AI-R07; AI-R08; AI-R23; AI-R24 | 15 | D10 (1); L06 (12); L16 (2) |
| AI-CTRL-025 | Agent Containment and Kill Switch | AI-R07; AI-R11; AI-R21; AI-R25 | 11 | D09 (1); D10 (2); D12 (1); D13 (1); L06 (5); L17 (1) |
| AI-CTRL-026 | Agent Memory and Context Integrity | AI-R05; AI-R07; AI-R21 | 5 | L07 (5) |
| AI-CTRL-027 | Agent Execution Isolation | AI-R07; AI-R21; AI-R22; AI-R25 | 11 | D10 (6); L06 (5) |
| AI-CTRL-028 | Model Protection | AI-R08 | 18 | D11 (1); L12 (14); L13 (1); L15 (1); L16 (1) |
| AI-CTRL-029 | Training and Fine-Tuning Data Integrity | AI-R08 | 16 | D12 (1); L13 (14); L14 (1) |
| AI-CTRL-030 | ML Pipeline and Model Registry Security | AI-R08 | 16 | D08 (1); L07 (1); L12 (2); L13 (2); L14 (10) |
| AI-CTRL-031 | AI Supply Chain and AI-BOM | AI-R08; AI-R16; AI-R23 | 24 | L05 (1); L08 (2); L12 (6); L13 (1); L14 (1); L16 (13) |
| AI-CTRL-032 | AI Infrastructure Hardening | AI-R08; AI-R10 | 27 | L06 (1); L09 (1); L10 (1); L11 (2); L12 (1); L13 (1); L14 (5); L15 (14); L16 (1) |
| AI-CTRL-033 | AI Security Review and Release Gate | AI-R05; AI-R07; AI-R08; AI-R14; AI-R16 | 6 | L01 (4); L06 (1); L14 (1) |
| AI-CTRL-034 | Adversarial Testing and Continuous Evaluation | AI-R05; AI-R07; AI-R16; AI-R17; AI-R20 | 36 | D08 (25); D12 (1); L05 (1); L07 (2); L12 (2); L13 (1); L14 (3); L17 (1) |
| AI-CTRL-035 | AI Incident Response and Forensics | AI-R09; AI-R20 | 39 | D09 (1); D12 (22); L03 (2); L10 (2); L16 (2); L17 (10) |
| AI-CTRL-036 | AI Cost and Abuse Controls | AI-R11 | 30 | D11 (1); D13 (21); L06 (1); L07 (1); L08 (2); L12 (2); L13 (1); L15 (1) |
| AI-CTRL-037 | AI Risk Assessment and Exception Management | AI-R02; AI-R18; AI-R28 | 10 | L02 (7); L04 (3) |
| AI-CTRL-038 | Control Assurance and Audit Evidence | AI-R09; AI-R15; AI-R28 | 17 | D09 (1); L02 (10); L03 (5); L10 (1) |
| AI-CTRL-039 | Output Reliability and Content Safety | AI-R12; AI-R14; AI-R20 | 8 | L03 (2); L05 (3); L08 (2); L12 (1) |
| AI-CTRL-040 | AI Service Resilience and Fail-Safe Operation | AI-R13; AI-R16 | 13 | L01 (1); L05 (2); L08 (4); L11 (1); L12 (1); L15 (1); L16 (2); L17 (1) |
| AI-CTRL-041 | Fairness, Bias Testing and Explainability | AI-R12; AI-R14; AI-R15 | 3 | L03 (3) |
| AI-CTRL-042 | Fundamental Rights and Data Protection Impact Assessment | AI-R10; AI-R12; AI-R28 | 1 | L03 (1) |
| AI-CTRL-043 | Regulator and Authority Engagement | AI-R09; AI-R10 | 1 | L03 (1) |
| AI-CTRL-044 | AI Literacy and Role-Based Competence | AI-R02; AI-R19 | 1 | L03 (1) |
| AI-CTRL-045 | Human Oversight Design and Effectiveness | AI-R07; AI-R12; AI-R14; AI-R18; AI-R19; AI-R28 | 3 | L01 (1); L03 (2) |
| AI-CTRL-046 | Intellectual Property and Copyright Governance | AI-R27 | 4 | L03 (2); L05 (1); L13 (1) |
Gaps
| Check | Result |
|---|---|
| Controls with no test case | None |
| Risks treated by a control that has no test case | None |
| Controls that no risk maps to | None |