The Unified Risk Model in practice — every question is a recipe

What this is — the bridge, and the start of the journey

Data morphology is the language; the Unified Risk Model is what we point it at. This log is the bridge: it takes the model’s real practitioner questions and shows that every one decomposes into the same small set of moves — shape → transform → reshape → draw — and which visualization each lands in (in any tool, not just Obsidian). It’s the opening of an end-to-end run of Crosswalker on the GRC corpus.

Where this connects — language: data morphology · model: foundations + building the model · application: GRC corpus end-to-end · concepts: query primitives · view shapes · terminology.

One graph, three lenses

The Unified Risk Model is one typed graph — a peer mesh of nodes joined by typed edges, no privileged backbone. Risk is the gravitational center (a control is defined as a risk-reducer; even audit is risk-based); Control is the convergence point (where governance mandates, risk mitigations, and compliance requirements all land as the same act). The “lenses” aren’t separate models — each lens is a projection / subgraph you read for a purpose.

Nodes (the things):

Node	One-line	Key attributes
Objective	what the org is trying to achieve — the reference point	—
Risk	a possible future event (likelihood × impact) that matters because it affects an objective	inherent · residual · treatment · appetite_band
Obligation	a standing duty that binds you to act (an authority commands it)	authority_source
Control	the mechanism that modifies risk — and so satisfies obligations + protects objectives	function_type · design_status · operating_status
Evidence	a persisted artifact demonstrating a control is implemented	status · freshness · evidence_type
Finding	audit’s persisted judgment — the one thing audit writes (the only new node)	severity · status · engagement_id
Framework	a source ontology (NIST 800-53, CIS, CRI…) with its own concepts + versioning	—

Edges (the relations):

Edge	From → To	Carries
mitigates	control → risk	effectiveness
satisfies	control → obligation	—
requires	obligation → control	—
evidences	evidence → control	status · freshness
concerns	finding → control / risk / obligation	—
crosswalk	concept ↔ concept (framework ↔ framework)	STRM relation + SSSOM confidence
broader / narrower	concept ↔ concept	hierarchy within a framework

The three lenses just read different slices of this:

Lens	The practitioner question	Reads (subgraph)
Control	”implement once, satisfy many”	control —satisfies→ obligation; concept ↔ crosswalk ↔ concept
Assurance	”is it real, and is it covered?“	evidence —evidences→ control; finding —concerns→ control; design/operating_status
Risk	”buy risk down to appetite”	control —mitigates→ risk; inherent→residual vs appetite_band

Every question is a recipe

Here is the whole claim of this page: pick a lens (a subgraph), then every useful question is a composition of the same moves — select → combine → summarize → traverse → compare, maybe a reshape, ending in a draw. (The move vocabulary is the data-morphology language — each is a worked example there.)

Read the catalog below as: question → the recipe → how you’d draw it. The “draw” is tool-agnostic — Obsidian Bases is one renderer; the same shaped result drops into a BI tool, a notebook, or D3.

Catalog — by lens

Status: ✅ buildable on today’s corpus (frameworks + controls + crosswalk edges) · 🟡 needs the evidence / risk / finding nodes populated (model-ready, data-pending).

Control lens — “implement once, satisfy many”

Question	Recipe (the moves)	Draw	Status
Where do framework A & B overlap?	traverse (crosswalk) → summarize (count by group) → reshape (wide)	pivot / heatmap	✅
Which controls satisfy A and B and C at once?	traverse (control →satisfies→ obligation) → summarize (count distinct frameworks) → select (≥ 3)	table / ranked list	✅
Control reuse — which controls satisfy the most obligations?	traverse (satisfies) → summarize (count per control) → sort	bar / ranked table	✅
Which obligations are satisfied by no control? (coverage gap)	obligation combine▷ control (anti-join over satisfies)	gap list	🟡
For control C: every requirement it satisfies, by framework	select (C) → traverse (satisfies) → summarize (group by framework)	grouped table	🟡

Assurance lens — “is it real, and is it covered?”

Question	Recipe (the moves)	Draw	Status
Which controls have no evidence?	control combine▷ evidence (anti-join over evidences)	gap list	🟡
Assurance coverage % by control family	control combine⟕ evidence (left join) → summarize (% per family) → reshape	rollup / heatmap	🟡
Stale / expired evidence	select (freshness = stale) → combine (→ control)	highlighted table	🟡
Controls failing design or operating effectiveness	select (status = fail)	list	🟡
Open findings by control family × severity	select (finding open) → traverse (concerns→ control) → summarize → reshape	pivot	🟡
Findings lifecycle over time (open → remediated)	select (findings) → reshape (by date/status)	timeline	🟡

Risk lens — “buy risk down to appetite”

Question	Recipe (the moves)	Draw	Status
Which risks are unmitigated (no control)?	risk combine▷ control (anti-join over mitigates)	gap list (the scary one)	🟡
Which residual risks breach appetite?	select (residual > appetite_band) → sort	list / bar	🟡
Top controls by risk reduced	traverse (control →mitigates→ risk) → summarize (sum effectiveness) → sort	bar / ranked table	🟡
Risk category × control family coverage	traverse (mitigates) → summarize (count) → reshape (wide)	heatmap	🟡
Inherent → residual burn-down per risk	select (risk) → bind (inherent − residual)	waterfall / before-after bar	🟡

Cross-lens chains — the powerful compositions

These are the “more than a couple relationships” questions — multi-hop walks across lenses. None is a new primitive; each is a longer recipe.

Question	Recipe (the moves)	Draw
Audit story for risk R — R → controls mitigating it → evidence → open findings	select (R) → traverse (R ←mitigates← control) → combine (← evidences ← evidence) → combine (← concerns ← finding, open)	node-link neighborhood / tree
Control 360 — pick a control → its obligations, risks, evidence, findings	select (control) → traverse (out: satisfies, mitigates; in: evidences, concerns)	neighborhood graph / 360 card
FI assurance posture (CRI) — CRI obligations → 800-53 controls → evidence → gaps, by family	select (CRI) → traverse (crosswalk → 800-53) → traverse (← satisfies ← control) → combine⟕ evidence → combine▷ (no evidence = gap) → summarize (by family)	rollup + gap list

CRI is a financial-sector (FI) profile / authority-of-record, not a universal spine — these questions are scoped to FI, never written as generally applicable.

A worked end-to-end — “audit story for a risk”

One cross-lens question, fully decomposed, to show how the moves chain (and how each step is a familiar data-morphology move):

1 · SELECT

pick the risk

filter Risk = “ransomware”

2 · TRAVERSE

→ its controls

walk ←mitigates← Control

3 · COMBINE

+ evidence

join ←evidences← Evidence

4 · COMBINE

+ open findings

join ←concerns← Finding (open)

5 · DRAW

the story

tree: risk → controls → evidence + findings

Five moves, one graph, one human question — “for ransomware, what protects us, can we prove it, and what’s broken?”

The output is a small tree (one risk, a handful of controls, their evidence and findings) — drawable anywhere. The graph stayed in the substrate; we walked a tiny neighborhood of it and projected the result.

Visualization map (tool-agnostic)

The draw knob is where this becomes a picture — and the shape of the question picks the chart, regardless of renderer:

Question shape	Natural visualization
coverage / density (A × B)	heatmap / matrix (pivot)
gaps / orphans (anti-join)	highlighted list / filtered table
rankings (top-N)	bar chart / sorted table
risk burn-down (inherent → residual)	waterfall / before-after bar
findings / changes over time	timeline / line (a sequence drawn)
neighborhood (control 360, audit story)	node-link graph (small) / tree
hierarchy drill-down	sunburst / treemap / indented tree

The point: choose the shape + transforms first (tool-agnostic), and the visualization follows. Obsidian Bases renders many of these today; the rest export cleanly to a notebook or BI tool because the result is just a tidy table or edge-list.

The journey from here

This is the map; the trip is running the recipes on the real corpus. Composition is the whole game — a small closed set of moves answers an unbounded set of questions, because the lenses are projections and the questions are pipelines. Next legs:

1. Build the ✅ Control-lens views on the live crosswalk corpus (overlap, reuse, multi-framework satisfaction) — they need only what’s already ingested.
2. Populate the 🟡 nodes — evidence / risk / finding — to unlock the Assurance and Risk lenses, then the cross-lens chains.
3. Restructure the GRC corpus log so its output/query stage speaks this language, ordered by lens.

Related

• Data morphology — the language (shapes · transform/reshape/draw · the worked moves)
• Unified control model — ontological foundations · Building the unified model
• GRC corpus end-to-end — the use-case this runs on
• Query primitives · View shapes · Terminology