83filers, current period
67the period before
3controls it touches
3frameworks
The long view
No history has been measured for this phrase yet. It is being backfilled, and this will fill in rather than stay empty.
Who disclosed it
From SEC full-text search over 8-K filings. Every row links to the filing itself.
| Company | Form | Filed | |
|---|
| Sharps Technology Inc. | 10-Q | 2026-05-14 | filing |
| SideChannel, Inc. SDCH | 8-K | 2026-05-12 | filing |
| PATHWARD FINANCIAL, INC. CASH | 8-K | 2026-07-22 | filing |
| EQUITY BANCSHARES INC EQBK | 8-K | 2026-07-14 | filing |
| ALLIANT ENERGY CORP LNT | 8-K | 2026-05-01 | filing |
| INTERSTATE POWER & LIGHT CO | 8-K | 2026-05-01 | filing |
| WISCONSIN POWER & LIGHT CO | 8-K | 2026-05-01 | filing |
| ServiceNow, Inc. NOW | 8-K | 2026-07-22 | filing |
| FIRST BUSEY CORP /NV/ | 8-K | 2026-04-28 | filing |
| Bridgewater Bancshares Inc | 8-K | 2026-05-04 | filing |
| Regional Management Corp. RM | 10-Q | 2026-05-01 | filing |
| Seneca Foods Corp | 10-K | 2026-06-11 | filing |
| Q2 Holdings, Inc. QTWO | 10-Q | 2026-04-29 | filing |
| SPECTRAL CAPITAL Corp FCCN | 10-K/A | 2026-06-05 | filing |
| WORLD ACCEPTANCE CORP WRLD | 10-K | 2026-06-04 | filing |
| 8X8 INC /DE/ EGHT | 10-K | 2026-05-22 | filing |
The full search on EDGAR
Which industries file it
Companies grouped by the industry classification on their own filing. A count, not a
survey.
| Industry | | Companies |
|---|
| Software and IT services | | 25 |
| Banking | | 22 |
| Chemicals and pharmaceuticals | | 15 |
| Instruments and medical devices | | 11 |
| Securities and investment | | 6 |
| Utilities | | 6 |
| Holding and investment offices | | 6 |
| Industrial machinery | | 6 |
| Business services | | 5 |
| Electronics and electrical equipment | | 5 |
What it obligates
Our corpus holds 3 controls across
3 frameworks whose text speaks to this. Not a judgement:
these controls say so, and each is one lookup from its source document. Ordered by how much each
framework has to say about it, so the one that will cost you the most work is first. Every name
opens that framework in the corpus.
What an auditor will ask you to produce
The artefacts named on those controls, most frequently cited first.
- TPRM policy
- Vendor inventory
- Due diligence files
- SOC 2 reports
- Vendor risk assessment library
- PRA SS2/21 alignment evidence
- Critical Third Party (CTP) designation tracking
- Concentration risk analysis
How it usually fails
Recorded when each control was verified against its source. This is where programmes
that think they are covered turn out not to be.
- Third party inventory is incomplete and excludes fourth party dependencies
- Due diligence is performed at onboarding but not refreshed periodically
- Vendor risk tiering criteria are subjective and not consistently applied
- Right to audit clauses are present but not exercised
- No PRA SS2/21 alignment
- No CTP analysis
Where this comes from
The left half is public record: SEC full-text search over 8-K filings, counted across a
14 day window against the equivalent window before it. You can check
every row.
The right half is ours: 723 frameworks and
20,473 controls, 531 of those frameworks verified against
their source documents, with the auditor evidence and common failure modes recorded control by
control. Controls appear here because their own text names this term.
Today's edition ·
How programmes fail ·
The obligation index