content_category: Risk Management Process

category_confidence: high

specificity_confidence: high

reasoning: The paragraph describes internal cybersecurity processes including assessments, audits, training, and incident response planning, which clearly fits Risk Management Process. For specificity, after filtering all items against the NOT list, zero IS-list facts remain: 'Cyber Incident Response Plan' is a generic program name without a unique identifier (unlike 'CIRP' in the IS example), 'Cheniere' is a company self-reference, 'Board' is generic governance, 'third parties' are unnamed entities, and all other elements (penetration tests, training programs, annual cadences) are common practices or vague quantifiers. Annotators A and B correctly applied the codebook; Annotator C erroneously counted the generic 'Cyber Incident Response Plan' as a firm-specific fact when it lacks the distinguishing abbreviation required by the IS list.

provider: z-ai


content_category: Board Governance

reasoning: The paragraph describes the board's oversight mechanism—specifically how the board receives presentations and updates from management on cybersecurity risks. The disambiguation rule explicitly states that 'Board or board committee taking oversight actions (receiving briefings, reviewing risks) → Board Governance.' Although management is the grammatical subject in two sentences, management's role here is in service of the board's oversight function (providing information TO the board), making Board Governance the correct category. I agree with Annotators A and B; Annotator C erred by focusing on sentence-level grammatical subjects rather than applying the disambiguation rule about board oversight actions. All annotators correctly identified Generic Boilerplate—no facts from the IS list appear (board of directors, management, periodic, and cybersecurity program are all on the NOT list).


reasoning: Annotator B correctly applied the codebook. After filtering, all items in this paragraph fall on the NOT list: 'ERM' is a generic program name without a unique identifier (compare to IS example 'Cyber Incident Response Plan (CIRP)'), 'Atleos' is a company self-reference, 'Board of Directors' is generic governance, and 'executive leadership' is generic C-suite language. No cybersecurity-specific roles (CISO, CTO, CIO), named frameworks (NIST, ISO 27001), specific dates, named third-party firms, or quantified facts appear. Annotators A and C erroneously counted the ERM program name and standard governance elements as firm-specific facts, but these are explicitly excluded by the codebook.


reasoning: The paragraph describes internal incident response processes, correctly classified as Risk Management Process. For specificity, 'CIRT' is a named internal program with a unique identifier abbreviation, directly matching the IS-list example 'Cyber Incident Response Plan (CIRP)'. Annotators A and C correctly recognized this; Annotator B erred by not counting the abbreviation as a unique identifier. While 'Cyber Security Watch Team' is borderline (no abbreviation), the presence of CIRT alone satisfies the Firm-Specific threshold.


reasoning: I agree with Annotators A and B. The paragraph contains no IS-list facts after filtering. 'Audit and Risk Committee' is a standard committee variant—the codebook explicitly lists 'Audit Committee' as generic, and adding 'and Risk' does not transform it into a non-generic committee like 'Technology Committee' or 'Cybersecurity Committee.' Annotator C incorrectly counted this standard committee name as a firm-specific fact. All other elements (Board, independent directors, enterprise risk assessment, regular reviews, insurance coverage) are generic governance language or common practices on the NOT list.


content_category: Management Role

reasoning: Annotator A correctly identified that this paragraph meets the Quantified-Verifiable threshold. The disambiguation rules explicitly state that 'Years of experience' such as '17 years' or 'over 20 years' count as hard verifiable facts. This paragraph contains three such QV-eligible facts: 'past four years', 'over 13 years of total experience', and 'over 40 years of combined experience'. Annotators B and C correctly identified Firm-Specific facts but failed to recognize that years of experience qualify as quantified facts toward the QV threshold.


reasoning: The paragraph focuses on the CDIO's role and qualifications, clearly fitting Management Role. It contains two QV-eligible facts: the specific date 'January, 2022' when the CDIO assumed his role, and 'over 20 years' of experience. Per the disambiguation rules, both specific dates and years of experience count toward the Quantified-Verifiable threshold. Annotator B correctly identified this; Annotators A and C undercounted by not recognizing both facts as QV-eligible.


category_confidence: medium

reasoning: The disambiguation rules explicitly list 'receiving briefings' as a board oversight action that triggers Board Governance. Although 'Management' is the grammatical subject, the paragraph's communicative purpose is to disclose how the Audit Committee exercises oversight by receiving updates on cybersecurity incidents. Annotators B and C correctly identified this as Board Governance; Annotator A over-weighted the grammatical subject test without accounting for the rule that 'receiving briefings' constitutes board oversight. All annotators correctly identified Generic Boilerplate specificity—'Management', 'Audit Committee', and 'as necessary' are all on the NOT-list, and no IS-list facts appear.


content_category: Third-Party Risk

reasoning: I agree with Annotator A. The codebook explicitly lists 'Third-Party Risk Management Program' on the NOT list as a generic program name without unique identifiers, comparing it unfavorably to 'Cyber Incident Response Plan (CIRP)' which has a distinguishing abbreviation. Annotators B and C incorrectly counted this as a firm-specific fact. After filtering out all NOT-list items (company self-references 'Dime' and 'The Bank', the generic program name, and common practices like due diligence/monitoring), zero IS-list facts remain, making this Generic Boilerplate.


reasoning: The paragraph focuses on a management role's qualifications and cybersecurity oversight responsibilities, clearly fitting Management Role. Per the disambiguation rules, years of experience count as QV-eligible facts. The text contains two such facts (35 years and 24 years), meeting the Quantified-Verifiable threshold. Annotators B and C correctly identified this; Annotator A erred by not counting years of experience as hard verifiable facts despite the explicit disambiguation rule stating they qualify.


reasoning: The paragraph describes an internal risk assessment process using China's MLPS cybersecurity framework, which qualifies as a named recognized standard for Sector-Adapted specificity. Annotator A correctly applied the codebook; Annotators B and C erroneously counted 'IT Manager' as a cybersecurity-specific title, but the codebook explicitly lists only CISO, CTO, CIO, VP of IT/Security, Information Security Officer, Director of IT Security, and HSE Director—IT Manager is not included. Additionally, 'CFO' is on the NOT list as generic C-suite, and 'JiuGe Technology' is a company self-reference (subsidiary), not a named third-party firm. No facts from the IS list remain after filtering, so the paragraph does not reach Firm-Specific.


reasoning: The paragraph describes the company's internal processes for identifying, assessing, monitoring, and mitigating cybersecurity risks. Annotators B and C correctly applied the codebook. Annotator A erred by treating generic 'Management' as triggering Management Role, but the codebook requires cybersecurity-specific roles (CISO, CTO, CIO) and the disambiguation rules specify that when a role mention is incidental to process description, the category is Risk Management Process. 'Management' is on the NOT-list as generic governance, and removing it leaves a coherent process description about risk assessment and mitigation activities.


reasoning: The paragraph's dominant communicative purpose is describing the company's internal cybersecurity risk mitigation processes (application design, backup systems, monitoring, detection, anti-malware, training, audits, and response capabilities). The management role mention at the end is secondary—the test of removing it leaves a coherent process description. Annotator A correctly applied both category and specificity rules. Annotators B and C erred by counting 'Head of IT department' as a specific fact, but this title is NOT on the IS list (which specifies CISO, CTO, CIO, VP of IT/Security, Information Security Officer, Director of IT Security—cybersecurity-specific roles). 'Head of IT department' is generic IT leadership. CEO and Audit Committee are explicitly on the NOT list. No IS-list facts remain after filtering.


reasoning: All annotators correctly identified Third-Party Risk as the category. For specificity, Annotators B and C correctly applied the codebook. Annotator A erroneously counted 'Risk Dependency Assessment', 'Tier Level', and 'Critical Vendors' as specific facts, but these are generic program names and common vendor management terminology without unique identifiers—explicitly on the NOT list alongside examples like 'Third-Party Risk Management Program'. After filtering out NOT-list items (generic program names, company self-reference 'the Bank'), zero IS-list facts remain, making this Generic Boilerplate.


reasoning: Applying the disambigration test: removing the CIO and CISO mentions, the paragraph still makes complete sense as a description of the company's information security program, SOC operations, and incident response processes. The CISO qualifications (one sentence) are not the PRIMARY content; the dominant communicative purpose is describing internal risk management processes. Annotator A correctly identified the category. For specificity, Annotator C erred by counting named roles (CIO, CISO) toward the QV threshold—per the codebook, named roles trigger Firm-Specific but do NOT count as QV-eligible facts. Only one QV-eligible fact exists (38 years of experience), so the paragraph stays at Firm-Specific.


reasoning: Annotators A and C correctly applied the codebook. After filtering, the paragraph contains zero IS-list facts: 'Information Technology (IT) Team' and 'Software Engineer' are generic IT roles NOT on the IS list (which specifies CISO, CTO, CIO, VP of IT/Security, Information Security Officer, Director of IT Security). 'Cybersecurity risk management program' is a generic program name without a unique identifier. No named frameworks (NIST, ISO), specific dates, named third parties, or verifiable numbers appear. Annotator B erroneously treated generic organizational roles as firm-specific facts.


content_category: None/Other

reasoning: The paragraph contains no substantive cybersecurity disclosure—it is generic IT-dependence language describing hypothetical impacts of incidents without any governance structure, management role, risk process, incident narrative, or specific strategy discussion. The disambiguation rules explicitly state that paragraphs establishing only that the company has IT systems without describing any program, process, or strategy should be classified as None/Other. Annotators A and B correctly applied this rule; Annotator C erred by treating boilerplate hypothetical impact language as Strategy Integration, which requires actual discussion of business/financial impact, insurance, budget, or materiality assessment—not generic risk disclosure about what 'could' happen.


reasoning: The grammatical subject is 'Senior management,' and the paragraph describes management's responsibilities for creating and recommending risk appetite metrics. The Board is mentioned only as the recipient of management's recommendations, not as the active party performing oversight actions. I agree with Annotators B and C; Annotator A incorrectly classified this as Board Governance by focusing on the Board's passive role as recipient rather than recognizing that management is the grammatical subject and primary focus. No IS-list facts exist—'Senior management' and 'Board of Directors' are both generic terms on the NOT-list.


reasoning: The paragraph focuses on the VP of IT's role, qualifications, and team—management roles are the grammatical subjects throughout. For specificity, there is only ONE QV-eligible fact: 'over 20 years' of experience. The VP of IT title triggers Firm-Specific but does NOT count toward QV (per disambiguation rules: 'Named roles — these trigger Firm-Specific but do NOT count as QV facts'). Named frameworks (NIST, CIS, ISO 27001) also do NOT count toward QV. Generic degrees without named universities don't count either. With only one QV-eligible fact, the paragraph stays at Firm-Specific. Annotators B and C correctly applied the rules; Annotator A erroneously counted named roles and named frameworks toward the QV threshold.


reasoning: The paragraph names the NIST Cybersecurity Framework, qualifying it as Sector-Adapted, but contains no genuine firm-specific facts from the IS list. Annotators A and B correctly determined that 'product development and technology management teams' are generic organizational units common to most technology companies—not unique identifiers like 'Legal, Compliance, and Finance' which would indicate a specific departmental composition. Annotator C erroneously treated these generic team names as firm-specific facts. The paragraph also lacks specific dates, named third-party firms, headcounts, or named tools that would elevate it to Firm-Specific or Quantified-Verifiable.


reasoning: The grammatical subjects across the paragraph are predominantly the audit committee and Board of Directors (sentences 1, 2, and 4), which receive reports and are informed of incidents based on materiality. The incident escalation in sentence 3 describes an oversight reporting chain culminating in board notification, not operational risk management processes. Annotator A correctly identified Board Governance as the primary focus. Annotator B erred by treating incident escalation protocols as RMP when they describe governance reporting lines. Annotator C overemphasized the management role mentions, which are incidental to the board oversight structure—the ISO/CISO appear only as intermediaries in a process that terminates with audit committee notification.


reasoning: The paragraph's primary subject is the company's cybersecurity risk management processes—integration with ERM, penetration testing, IT security team reviews—with board oversight mentioned as one component of that process. The disambiguation rule explicitly states: 'We conduct quarterly risk assessments; the board is informed' → RMP (process is primary content). Annotators A and B correctly applied this rule; Annotator C erred by treating board mentions as the primary focus when the opening subject is 'Cybersecurity risk management processes' and the bulk of content (three enumerated examples) describes operational activities. CTO is the only IS-list fact (cybersecurity-specific title); 'at least annually' is generic cadence, 'Audit Committee' is standard, and no QV-eligible facts appear.


reasoning: Annotator A correctly applied the codebook. After filtering, no IS-list facts remain: (1) 'third-party security expert consultant' is an unnamed entity explicitly on the NOT list; (2) 'over 30 years' is an approximate duration, not an 'exact duration' as required by the IS list—compare to the calibration example where '17 years' (exact) counted but 'approximately two weeks' (approximate) was called 'soft'; (3) 'advanced security tools' is generic with no named products. Annotators B and C erroneously counted the approximate 'over 30 years' as a specific fact, but the codebook requires 'exact durations' for the IS list, and vague quantifiers are explicitly filtered out.


reasoning: The paragraph focuses on Board and Audit Committee oversight of cybersecurity risks, with the Audit Committee as the grammatical subject, clearly fitting Board Governance. After filtering, no IS-list facts remain: 'Audit Committee' is explicitly on the NOT list as a standard committee; 'cybersecurity and data privacy leadership team' is a generic functional description, not a specific composition like 'Legal, Compliance, and Finance'; 'Internal Audit team' and 'executive leadership team' are generic; and 'annual/quarterly/regular' are generic cadences without exact dates. Annotators A and C correctly applied the codebook; Annotator B erroneously counted 'cybersecurity and data privacy leadership team' as a specific team composition when it is merely a functional description that could apply to any company.


reasoning: Annotators A and C correctly identified this as Generic Boilerplate. After filtering NOT-list items, zero IS-list facts remain: 'Management' and 'Board of Directors' are generic governance terms; 'incident response plan' is explicitly on the NOT list as a generic program name; 'Initial Public Offering' is not a specific date; and there are no named frameworks, cybersecurity-specific roles (CISO/CTO/CIO), named firms, named products, or quantified facts. Annotator B erred by treating 'incident response plan' as firm-specific when the codebook explicitly lists this as a generic program name that does not qualify.


specificity_confidence: medium

reasoning: The paragraph describes the company's risk management structure—how cybersecurity risk assessment, identification, and management flow through the Manager to the IT Service Provider. The IT Service Provider is a component supporting the internal process, not the central topic of vendor oversight (compare to the disambiguation example: 'We use third-party consultants for penetration testing' = RMP). Annotators A and B correctly identified the category but missed the 'no employees' headcount fact that elevates specificity to Firm-Specific. Annotator C correctly identified the headcount fact but misapplied the category by treating the IT Service Provider as the central topic when it serves the company's risk management process.


reasoning: Annotator B is correct. The paragraph consists entirely of generic IT-dependence language ("our business depends on" IT systems, "we recognize the importance of" cybersecurity measures) without describing any actual processes, activities, governance structures, or strategic decisions. Per the disambiguation rules: "Only stating the company has IT systems, collects data, or faces cyber risks — without describing what it DOES about them → None/Other." Annotator A erred by classifying as Strategy Integration when there is no discussion of financial impact, insurance, budget, or materiality. Annotator C erred by classifying as Risk Management Process when the paragraph merely states the company "recognize[s] the importance of developing, implementing, and maintaining" measures — aspirational language that does not describe actual processes or activities.


reasoning: The paragraph's dominant communicative purpose is describing internal risk management processes (monitoring, detection, anti-malware, training, audits, backup systems), with the Head of IT mention appearing only in the final two sentences as part of explaining oversight structure. Applying the disambiguation test: removing the role mention leaves a coherent process description, indicating RMP is correct. Annotator C applied the codebook properly; Annotators A and B treated the brief role attribution as primary content when it is incidental to the extensive process description.


reasoning: The paragraph names the NIST Cybersecurity Framework, which qualifies as Sector-Adapted. Annotator B correctly applied the codebook. Annotators A and C erroneously counted Harley-Davidson as a 'named third-party firm,' but Harley-Davidson is a motorcycle manufacturer and business affiliate (per the Master Services Agreement), not a cybersecurity services firm like Mandiant or CrowdStrike. The codebook's examples of qualifying named firms are all professional services/cybersecurity vendors. No other IS-list facts exist: penetration testing and vulnerability scanning are explicitly on the NOT list as common practices, 'third-party advisors' are unnamed entities, and the company explicitly disclaims certification claims.


reasoning: The paragraph describes management qualifications, correctly classified as Management Role. For specificity, the disambiguation rules explicitly list 'years of experience' and 'named certifications' as QV-eligible facts. The paragraph contains three such facts: 'nearly 30 years of experience,' 'more than 20 years of experience,' and 'CISSP certification.' This exceeds the two-fact threshold for Quantified-Verifiable. Annotator B correctly identified these QV-eligible facts. Annotator A erred by not counting the years of experience toward the QV threshold, treating them only as Firm-Specific details. Annotator C reached the correct conclusion but provided minimal supporting reasoning.


reasoning: Applying the disambiguation test: the CEO is mentioned only for brief attribution (no identity, qualifications, or reporting structure described), and the dominant content describes the incident response team structure, which falls under IR planning within Risk Management Process. For specificity, the team composition including 'mining operations' is a specific departmental makeup that identifies this mining company's disclosure, satisfying the IS-list criterion for Firm-Specific.


reasoning: The paragraph describes the company's internal cybersecurity monitoring, training, and security practices, which clearly falls under Risk Management Process. Annotator A incorrectly counted 'Information Systems Security department' as a firm-specific fact, but this is a generic department name—not a cybersecurity-specific title (like CISO, CTO, CIO), not a team composition listing specific units, and not a named program with unique identifier. After filtering all NOT-list items (unnamed 'third-party security vendors', generic 'quarterly' cadence, common practices like 'penetration testing' and 'phishing tests', and company self-references), zero IS-list facts remain. Annotators B and C correctly applied the codebook.


reasoning: The paragraph names the NIST Cybersecurity Framework multiple times, which qualifies it for Sector-Adapted. However, no genuine firm-specific facts remain after filtering: 'Centuri' is a company self-reference (NOT-list), 'Executive Leadership Team' is generic C-suite (NOT-list), 'quarterly' is a generic cadence (NOT-list), 'Cybersecurity Risk Register' is a generic program name without unique identifiers like an acronym (NOT-list), and 'third parties' are unnamed entities (NOT-list). Annotators A and C correctly applied Sector-Adapted; Annotator B erroneously counted 'Cybersecurity Risk Register' as firm-specific, but this is analogous to 'incident response plan' or 'business continuity plan' which are explicitly generic on the NOT-list.


reasoning: The paragraph describes how Liberty Broadband manages cybersecurity risks—through participation in Liberty's processes via a services agreement. This is clearly about the company's internal risk management processes, not vendor oversight. Annotators A and B correctly applied the codebook. Annotator C erred by treating Liberty (a parent/affiliate providing shared services) as a 'vendor' subject to oversight, but the disambiguation rules explicitly state that third parties supporting an internal process = Risk Management Process. The paragraph is about how the company assesses and manages cybersecurity threats, not about due diligence or monitoring of third-party controls. For specificity, Liberty and GCI are related entities (self-references), not external third-party firms, and no dates, named tools, certifications, or other IS-list facts appear.


reasoning: This paragraph is pure forward-looking risk factor language describing hypothetical consequences of a potential cybersecurity failure. It contains no substantive disclosure about governance, processes, incidents, or actual strategy—it merely states that security failures 'could result in' various harms and 'could have a material adverse impact.' This fits None/Other per the disambiguation rule: if the paragraph only establishes potential harms without describing any program, process, or strategy, it is not substantive disclosure. Annotator A correctly applied the codebook; Annotators B and C misclassified generic risk factor boilerplate as Strategy Integration by treating hypothetical impact language as actual discussion of business/financial impact strategy.


reasoning: Annotator A correctly identified that the team composition 'information security, technology, IT and operations personnel' qualifies as a firm-specific fact under the IS list, which explicitly includes 'Specific team/department compositions' like 'Legal, Compliance, and Finance' as an example. Annotator B incorrectly concluded there were no specific facts by missing this team composition. Annotator C reached the correct label but for the wrong reason—'daily' is a generic cadence on the NOT list ('quarterly, annual, periodic, regular — without exact dates'), not a verifiable fact. The team composition is borderline because the departments named are common, but it matches the codebook's example format for specific compositions.


reasoning: The paragraph's primary content describes the company's approach to cybersecurity risk management and its integration into a broader risk management framework—this is internal process description. The Board mention ('overseen by our Board of Directors') is a brief, passive reference at the end of the sentence, not the grammatical subject or primary focus. Applying the disambiguation rule: this resembles 'We conduct quarterly risk assessments; the board is informed' → RMP (process is primary content). Annotators B and C correctly identified that the risk management framework integration is the main topic; Annotator A incorrectly treated the ancillary Board mention as the primary subject despite it appearing in a passive construction.


reasoning: The paragraph is primarily a cross-reference to Item 1A risk factor disclosures with no substantive cybersecurity disclosure. The opening language ('describe whether and how risks... have materially affected...') reads as regulatory instruction language rather than an actual materiality assessment. The final sentence fragment about risk management processes and Board/management focus is generic boilerplate that could appear in any company's filing. Annotators A and B correctly identified this as None/Other; Annotator C erred by interpreting the cross-reference language as an actual materiality discussion when the paragraph provides no substantive assessment of business impact, insurance, budget, or materiality conclusions.


reasoning: This paragraph is generic forward-looking risk language stating that IT systems are important to operations and a cyber-attack could disrupt business—exactly the type of 'generic IT-dependence language' the disambiguation rules explicitly classify as None/Other. It describes no actual program, process, strategy, insurance, budget, or materiality assessment. Annotators A and B correctly applied the codebook; Annotator C erred by treating hypothetical impact language as Strategy Integration when the rules specify that paragraphs merely establishing IT dependence without describing any program, process, or strategy belong in None/Other.


reasoning: The grammatical subject throughout the paragraph is the CEO (a management role), not the Audit Committee. The paragraph describes the CEO's actions—'plays a pivotal role,' 'provide comprehensive briefings'—with the Audit Committee as the object receiving those briefings. Per the disambiguation rules, when a management role is the grammatical subject, the category should be Management Role. Annotator B correctly applied this rule; Annotators A and C erred by treating the Audit Committee's receipt of briefings as the primary focus when it is merely the object of the CEO's reporting actions. For specificity, CEO is generic C-suite (on the NOT list), Audit Committee is a standard committee (on the NOT list), and 'once per year' is a generic cadence without an exact date—yielding no IS-list facts.


reasoning: Applying the disambiguation test: removing the VP mention, the paragraph still makes complete sense as a process description. Three of four sentences describe the Cybersecurity Program's monitoring, prevention, detection, and remediation processes, with the VP mention serving only as incidental attribution at the start. For specificity, the VP of IT role triggers Firm-Specific, and 'over 25 years of experience' is one QV-eligible fact, but a second QV-eligible fact is lacking (named roles do not count toward QV threshold per disambiguation rules). Annotator C correctly applied both category and specificity rules; Annotators A and B erred by treating the brief role mention as the dominant purpose, and Annotator B further erred by counting the named role toward the QV threshold.


reasoning: Annotators A and C correctly applied the codebook. After strict filtering, no IS-list facts remain: 'Board' and 'Audit Committee' are generic governance (NOT list); 'Advisor', 'Sub-Advisor', 'Dealer Manager', and 'Inland' are company/related entity self-references (NOT list); 'incident response plan' is explicitly listed as a generic program name without unique identifier (NOT list); 'periodic' is a generic cadence (NOT list). Annotator B provided no specificity reasoning and appears to have made an error by not applying the NOT-list filter.


content_category: Strategy Integration

reasoning: The paragraph's dominant communicative purpose is delivering a materiality conclusion—stating that no cybersecurity threats have materially affected the company and that future risks could be material. The codebook explicitly assigns 'standalone materiality conclusions with no incident narrative' to Strategy Integration. Annotators A and C correctly identified this; Annotator B erred by treating the incidental mention of 'cybersecurity risk management program and processes' as the topic, when the paragraph does not describe HOW risks are assessed or mitigated—it merely references the program's existence in a forward-looking disclaimer. No IS-list facts are present; the language is entirely boilerplate that could apply to any company.


reasoning: Annotator B correctly applied the disambiguation rules. The paragraph is PRIMARILY about evaluating third-party service providers' security capabilities and imposing requirements on them (implement security measures, report breaches) - this is vendor oversight as the central topic, not vendors as a supporting component of an internal process. The disambiguation example 'We maintain a vendor oversight program with due diligence and monitoring of third-party controls = Third-Party Risk' is analogous to this paragraph's focus on evaluating vendor security. Annotators A and C erred by treating vendor evaluation as merely an 'internal process' without recognizing that when vendor oversight IS the topic (not just a component), it qualifies as Third-Party Risk per the tiebreaker rules. No IS-list facts are present - 'Board of Directors' and 'Audit Committee' are generic governance entities on the NOT list, and no specific dates, frameworks, named roles, or verifiable details appear.