23filers, current period
18the period before
4controls it touches
4frameworks
The long view
Filings containing this phrase, every month since 2008. The last
point is the current month and is still filling, so it always looks lower than it will be.
2008
peak 67 in March 2023
2026
Who disclosed it
From SEC full-text search over 8-K filings. Every row links to the filing itself.
| Company | Form | Filed | |
|---|
| OXO, Inc | 8-K | 2026-07-06 | filing |
| REX AMERICAN RESOURCES Corp REX | 10-Q | 2026-06-02 | filing |
| COLUMBIA BANKING SYSTEM, INC. COLB | 10-Q | 2026-05-05 | filing |
| U.S. GOLD CORP. USAU | 8-K | 2026-05-15 | filing |
| PubMatic, Inc. PUBM | 10-Q | 2026-05-07 | filing |
| Paramount Gold Nevada Corp. PZG | 8-K | 2026-06-23 | filing |
| BOK FINANCIAL CORP BOKF | 10-Q | 2026-05-06 | filing |
| FIRST HORIZON CORP | 10-Q | 2026-05-07 | filing |
| USCB FINANCIAL HOLDINGS, INC. USCB | 10-Q | 2026-05-08 | filing |
| Regional Management Corp. RM | 10-Q | 2026-05-01 | filing |
| CARMAX INC KMX | 10-Q | 2026-06-24 | filing |
| Ponce Financial Group, Inc. PDLB | 10-Q | 2026-05-07 | filing |
| Ramaco Resources, Inc. | 10-K/A | 2026-07-24 | filing |
| Athena Bitcoin Global ABIT | 10-Q | 2026-05-14 | filing |
| MICROSOFT CORP MSFT | 10-Q | 2026-04-29 | filing |
| TRUIST FINANCIAL CORP | 10-Q | 2026-05-01 | filing |
The full search on EDGAR
Which industries file it
Companies grouped by the industry classification on their own filing. A count, not a
survey.
| Industry | | Companies |
|---|
| Banking | | 14 |
| Chemicals and pharmaceuticals | | 3 |
| Software and IT services | | 3 |
| Mining and extraction | | 2 |
| Retail | | 1 |
| Securities and investment | | 1 |
| Electronics and electrical equipment | | 1 |
What it obligates
Our corpus holds 4 controls across
4 frameworks whose text speaks to this. Not a judgement:
these controls say so, and each is one lookup from its source document. Ordered by how much each
framework has to say about it, so the one that will cost you the most work is first. Every name
opens that framework in the corpus.
What an auditor will ask you to produce
The artefacts named on those controls, most frequently cited first.
- Ethical requirements specification + functional + non-functional + INCOSE/IEEE 29148 alignment
- Requirements per SMART + verifiable + traceable + acceptance criteria
- Value-based traceability matrix + source value + stakeholder + use case + risk + verification
- AI model validation + bias + fairness + explainability + robustness + adversarial + drift testing
- AI risk assessment aligned to NIST AI RMF + ISO/IEC 23894
- AI system categorisation by risk level
- model validation + testing + adversarial robustness evidence
- ongoing monitoring + drift + adversarial detection + red-team programme
How it usually fails
Recorded when each control was verified against its source. This is where programmes
that think they are covered turn out not to be.
- Ethical requirements aspirational (not SMART or verifiable)
- INCOSE/IEEE 29148 not applied (informal requirements)
- Traceability matrix absent (cannot link value to verification)
- AI validation only at deployment (no ongoing testing)
- one-time validation without continuous monitoring
- no adversarial robustness testing
Where this comes from
The left half is public record: SEC full-text search over 8-K filings, counted across a
14 day window against the equivalent window before it. You can check
every row.
The right half is ours: 723 frameworks and
20,473 controls, 531 of those frameworks verified against
their source documents, with the auditor evidence and common failure modes recorded control by
control. Controls appear here because their own text names this term.
Today's edition ·
How programmes fail ·
The obligation index