risk

type Decision struct {
	Date           string `yaml:"date"`
	Rationale      string `yaml:"rationale"`
	Reviewer       string `yaml:"reviewer"`
	ReviewInterval string `yaml:"review_interval"` // quarterly | annually | etc.
}

type LoadedFile struct {
	Path string
	Data RegisterFile
}

type RegisterFile struct {
	Register RegisterHeader `yaml:"risk_register"`
	Risks    []Risk         `yaml:"risks"`
}

type RegisterHeader struct {
	ID         string `yaml:"id"`
	Title      string `yaml:"title"`
	Owner      string `yaml:"owner"` // platform | operator
	LastReview string `yaml:"last_review"`
	NextReview string `yaml:"next_review"`
}

type Risk struct {
	ID                   string          `yaml:"id"`
	Finding              string          `yaml:"finding"`            // finding ID
	Profiles             []string        `yaml:"profiles,omitempty"` // empty = all profiles
	Title                string          `yaml:"title"`
	Severity             string          `yaml:"severity"`          // original severity
	ResidualSeverity     string          `yaml:"residual_severity"` // after compensating controls
	Status               string          `yaml:"status"`            // accepted | transferred | monitoring
	Description          string          `yaml:"description"`
	CompensatingControls []string        `yaml:"compensating_controls"`
	ResidualRisk         string          `yaml:"residual_risk"`
	Decision             Decision        `yaml:"decision"`
	Tracking             *audit.IssueRef `yaml:"tracking,omitempty"`
}

type RiskRef struct {
	File *LoadedFile
	Risk *Risk
}

type RiskSet struct {
	Files          []LoadedFile
	RisksByID      map[string]*RiskRef
	RisksByFinding map[string][]*RiskRef // finding ID -> risks
}