Risk Assessments

An assessment is a structured review of a case or a scoped scenario against your control library. The output is a draft for a named reviewer.

Create

POST /v1/risk/assessments
Authorization: Bearer eridian_sk_...
Idempotency-Key: assess-cse-0912-v1

{
  "project_id": "prj_risk_001",
  "case_id": "cse_0912",
  "catalog_id": "ctl_bank_rcsa_v3",
  "model": "gpt",
  "routing_policy": "quality_optimized",
  "questions": [
    "inherent_risk",
    "control_design",
    "control_operation",
    "residual_risk"
  ]
}

Required scope: risk:write.

{
  "id": "ras_0912",
  "object": "eridian.risk.assessment",
  "status": "draft",
  "model": "gpt",
  "scores": {
    "inherent_risk": "high",
    "residual_risk": "medium"
  },
  "findings": [
    {
      "control_id": "CTL-FC-14",
      "result": "gap",
      "evidence_ids": ["evd_02"],
      "body": "After-hours burst not in the current TM rule pack."
    }
  ],
  "reviewer_id": null,
  "eridian": { "route": "gpt", "region": "eu-west-1" }
}

Findings without evidence_ids are dropped. If every finding would drop, the assessment fails with 422 structured_output_failed rather than a free-prose memo.

Submit for review

POST /v1/risk/assessments/ras_0912/submit

{
  "reviewer_id": "usr_fc_lead"
}

Submit sets pending_review on the case when configured. The reviewer uses Risk Approvals (POST /v1/approvals) for risk.assessment.approve.

Scenario without a case

RCSA-style work can omit case_id and pass scope:

{
  "catalog_id": "ctl_bank_rcsa_v3",
  "scope": { "desk": "PX-12", "process": "outbound_payments" },
  "model": "gpt"
}

Those assessments still need evidence objects (policy PDFs, metrics extracts) attached via Case Evidence on a holding case or attachment_ids.

Versioning

Re-running creates ras_0912 version n+1. Prior versions remain for the examiner pack. Do not overwrite.

See Control Evidence and Evaluations (metrics: ["rubric_risk", "pii_leak", "citation_coverage"]).