Risk Governance and Compliance Review Protocol

A reasoned decision, with a traceable record.

Version 1.1 · October 2026

  1. Step 1

    Define the decision and its basis

  2. Step 2

    Establish what the evidence supports

  3. Step 3

    Assign responsibility by risk domain

  4. Step 4

    Open an issue and choose the next step

  5. Step 5

    Request evidence and track follow-up

  6. Step 6

    Record the decision and its limits

  7. Step 7

    Contract governance questions

Covered-materials module

  1. Find the covered material
  2. Check exceptions and record the basis
  3. Trace each stage
  4. Match evidence to stage
  5. Screen ownership
  6. Decide and record
  7. Build the indentured evidence record

CMMS-BS assesses what public sourcing disclosures establish. It is not a certification, an audit or legal advice.