10. Open questions

1. Which ladder? risks.sgit.ai and RiskMandate.ai publish different bands and a different default. The plan uses risks.sgit.ai's; a single published ladder would help every client conversation.
2. What exactly happens at expiry? The plan proposes return-to-desk then escalate-one-level. It needs testing on real clients.
3. Automatic roll-up, or pending until accepted? The published material disagrees. The plan takes automatic roll-up and should measure whether it produces alarm fatigue.
4. Interval inflation. risks.sgit.ai warns that pressure goes "into interval inflation, where everything is accepted for six months". What is the right check: a cap per rung, a board view of six-month acceptances, or both?
5. Who sets "acceptable"? And what stops a business unit setting the line wherever its exposure already is?
6. How far down to go. Fractal mapping can generate thousands of nodes. Where does materiality stop the zoom?
7. Twins and simulation. twins.sgit.ai describes risk acceptance performed by a twin acting for a person, and simulation of an organisation's risks. None of it is built. When is it worth building, and for which clients?
8. The first GRC partner. Which vendor has customers asking for this, and an API good enough to write back to?