M4 — Path

Where to intervene first.

Ranked by RAG, buffer days, stale controls and unowned dependencies. Named dependencies. Named owners. No status-report abstraction.

Off track

At risk

Controls stale

Unowned controls

Status	Regulation	Deadline	Buffer	Controls	Stale	Unowned	Score

Score combines RAG (0–100), buffer penalty, stale controls (×3) and unowned dependencies (×5). Higher scores need attention first.