ABDULLAH AL OWASIPrimary sources
Source register · reviewed 24 September 2026. Use the linked publications to verify framework scope and applicability.
Inspect the exact schema ↗KPI / KRI Management / Linked records, review criteria & decision outputs
KRI, appetite & management reporting.
Connect defined indicators, measurement dates and threshold direction to risk owners and escalation decisions.
Decision scope
Connect defined indicators, measurement dates and threshold direction to risk owners and escalation decisions.
Review capabilities
- Shared metric register
- Named ownership and review dates
- Linked source records
- Review and decision trail
Decision outputs
- grc-suite.json
- Reviewed decision rationale in linked decision records
Decision scope
Connect defined indicators, measurement dates and threshold direction to risk owners and escalation decisions.
Records & review
Use the shared metric register. Fields: id, title, owner, status, reviewDate, notes, definition, value, threshold, direction, unit, measuredDate, riskId. Records link by ID to related entities. Validate inputs, assign an owner and set a review date.
Connected workflow
Related workflows: executive-risk, continuous-assurance, remediation. Reuse linked records in suite views rather than duplicating facts. The suite and specialist workspace use distinct import formats; export and reconcile records explicitly when crossing between them.
Acceptance & handover
Review required fields, supporting evidence, relationships and decision rationale. Export the suite JSON dataset for handover. This workflow organizes oversight metadata; external collection, recovery testing and regulatory interpretation require separately verified evidence.
From portfolio logic to a bounded review.
Adapt this pattern
Bring the real decision boundary, authorized metadata, evidence available, accountable reviewers and target date. The workflow can then be scoped around explicit outputs and acceptance criteria.
Use the linked source records and assessment dates to review the scenario basis.