Enterprise Risk Management Data

[
  "351:00"
]

{
  "fn": "Export Import Bank - Office of Chief Financial Officer 202-565-3946, Option 0",
  "@type": "vcard:Contact",
  "hasEmail": "mailto:foia@exim.gov"
}

"51"

[
  "DAI",
  "Data Asset Inventory",
  "EXIM",
  "Enterprise Risk Management Data",
  "not public"
]

{
  "@id": "https://www.exim.gov/news/reports/other-reports",
  "@type": "Document",
  "title": "Enterprise Risk Management Data access page"
}

[
  "en"
]

[
  "351:000"
]

{
  "name": "EXIM",
  "@type": "org:Organization"
}

[
  "CIPSEA Determinations: Agencies are not expected to include this element in their comprehensive data inventories until it is reflected in the schema.",
  "FOIA Determination: Part of the data asset is exempt from disclosure under FOIA",
  "Open Data Indicator: Not yet determined",
  "Open Format Indicator: YES – subject to open format",
  "Open License Requirement: Not yet determined",
  "Public Data Asset Indicator: Not yet determined",
  "Restrictions: Privacy"
]

{
  "access": "https://www.exim.gov/news/reports/other-reports",
  "location": "Continental United States",
  "sourceID": "51",
  "sourceFile": "EXIM Data Asset Inventory_wID_2026-10-05.csv",
  "restrictions": "Restrictions: Privacy",
  "inventoryName": "Data Asset Inventory (DAI)",
  "dataAssetOwner": "EXIM",
  "foiaDetermination": "Part of the data asset is exempt from disclosure under FOIA",
  "openDataIndicator": "Not yet determined",
  "responsibleAgency": "EXIM",
  "openFormatIndicator": "YES – subject to open format",
  "variableDefinitions": "Risk_ID: Unique identifier assigned to each risk.
Fiscal_Year: Federal fiscal year associated with the risk record.
Date_Identified: Date the risk was initially identified.
Date_Modified: Date the risk record was most recently modified.
Enterprise_Risk_Flag: Indicates whether the record is designated an enterprise risk.
Risk_Profile_Flag: Indicates whether the risk is included in the prioritized Enterprise Risk Profile.
Status: Current lifecycle status of the risk record.
Candidate_Determination: Decision on whether a candidate proceeds for assessment or profile consideration.
Action: Current action or disposition required for the risk.
Division_Approval_Flag: Indicates whether the accountable division approved the record.
Division_Approver: Name or title of the division official approving the record.
ERM_Approver: Name or title of the ERM official approving the record.
Internal_Control_Approver: Name or title of the internal control official approving applicable control information.
Issue_Source: Origin from which the risk or issue was identified.
Office_Risk_Owner: Office accountable for management and monitoring of the risk.
Risk_Owner_Name: Individual accountable for managing and monitoring the risk.
Risk_Title: Concise name of the risk.
Risk_Description: Risk statement describing uncertain event or factor and consequence, preferably in if-then format.
Strategic_Plan_Objective: EXIM strategic goal or objective affected by the risk.
Framework_Risk_Category: Primary EXIM risk taxonomy category.
Framework_Risk_Category_Detailed: Approved risk subcategory used for detailed classification.
Portfolio: Portfolio, program, or business area associated with the risk.
Priority_Initiatives: Priority initiative associated with the risk.
Root_Cause_List: Underlying causes or drivers that may lead to occurrence of the risk.
Area_Impacted_by_Risk: Organizational, mission, operational, reporting, compliance, or other areas affected.
Interdependencies: Upstream, downstream, cross-office, system, vendor, or process dependencies affecting the risk.
Risk_Appetite: Amount and type of risk EXIM is willing to pursue or retain in support of objectives.
Risk_Tolerance: Maximum acceptable exposure or approved parameters around appetite for the risk.
Tolerance_Breach_Flag: Indicates whether current exposure exceeds approved tolerance.
Risk_Response_Type: Selected overall strategy for managing a threat or opportunity.
Risk_Response_Description: Specific response actions, timing, responsible parties, cost, and schedule as applicable.
Proposed_Action: Additional action proposed to reduce remaining exposure or pursue an opportunity.
Action_Owner: Individual accountable for a response action.
Action_Due_Date: Target completion date for a response action.
Inherent_Score_Likelihood: Likelihood rating before controls or additional management action.
Inherent_Score_Impact: Impact rating before controls or additional management action.
Inherent_Score_Velocity: Speed-of-onset rating before controls or additional management action.
Inherent_Risk_Rating: Approved overall risk rating before controls or additional management action.
Residual_Score_Likelihood: Likelihood rating after management action and controls.
Residual_Score_Impact: Impact rating after management action and controls.
Residual_Score_Velocity: Speed-of-onset rating after management action and controls.
Residual_Risk_Rating: Approved overall risk rating after management action and controls.
Control_ID: Unique identifier assigned to a control.
Control_Description: Activity or action designed to mitigate a risk and support objectives.
Control_Type: Nature of control relative to the risk.
Control_Effectiveness: Assessment of control design and operating effectiveness.
KRI_Name: Name of a key risk indicator used as an early warning measure.
KRI_Threshold: Trigger requiring action, contingency steps, or leadership elevation.
Monitoring_Frequency: Cadence for reviewing the risk, response, controls, or indicators.
Comments: Narrative rationale, update, challenge, decision, exception, or other audit-relevant context.
Evidence_Location: Reference to evidence supporting assessment, control, approval, or monitoring.
ERS_ID: Unique identifier for an Enterprise Risk System record.
ERS_System_Name: Official name of the enterprise application, platform, repository, service, or tool.
ERS_System_Type: Approved classification of the ERS system.
ERS_Business_Owner: Office or official accountable for business purpose, requirements, and use of the system.
ERS_System_Owner: Office or official accountable for system operation, maintenance, security coordination, and lifecycle.
ERS_Data_Owner: Official accountable for definitions, quality standards, access decisions, and authorized use of ERS data.
ERS_Data_Steward: Individual or team responsible for metadata maintenance, validation, quality monitoring, and issue coordination.
System_of_Record_Flag: Indicates whether the system is the authoritative source for the data domain.
Hosting_Model: How the ERS is hosted or delivered.
Data_Classification: Approved sensitivity or handling classification for data processed or stored.
Retention_Requirement: Approved records retention requirement or schedule reference.
Last_Review_Date: Date the ERS metadata and ownership assignment were last reviewed.
ERS_URL: Exact approved URL used to access or identify the ERS, SharePoint site, report portal, or governed file.
System_Acronym: Approved short name or acronym for the ERS.
Business_Capability: Business capability or function supported by the ERS.
Information_Owner: Official accountable for the information processed, stored, or transmitted by the ERS.
System_Criticality: Approved business or mission criticality designation.
FISMA_System_Flag: Indicates whether the ERS is tracked as a FISMA system.
ATO_Status: Current security authorization status, where applicable.
ATO_Expiration_Date: Expiration date of the applicable security authorization, where tracked.
PIA_Status: Status of the applicable privacy impact assessment or privacy determination.
Records_Schedule_Retention: Approved records schedule identifier and retention/disposition requirement.
Refresh_Frequency: Approved cadence at which ERS data or reports are updated.
RTO: Approved recovery time objective, where applicable.
RPO: Approved recovery point objective, where applicable.
Vendor_Service_Provider: Vendor or service provider supporting the ERS, where applicable.
Upstream_Systems: Systems or data sources providing information to the ERS.
Downstream_Systems: Systems, reports, or processes receiving information from the ERS.
Interface_Systems: Documented interfaces or integrations associated with the ERS.
Lifecycle_Status: Current lifecycle state of the ERS.",
  "cipseaDeterminations": "Agencies are not expected to include this element in their comprehensive data inventories until it is reflected in the schema.",
  "openLicenseRequirement": "Not yet determined",
  "publicDataAssetIndicator": "Not yet determined"
}

{
  "bbox": "POLYGON((-125 24, -66 24, -66 50, -125 50, -125 24))",
  "@type": "Location",
  "prefLabel": "Continental United States"
}

[
  "Enterprise Risk Management Data"
]