# EM-RSK-01 provider comparison

Claude and Grok agree that WM-KNW-015 remains the Risk / Opportunity identity, WM-XCT-027 becomes a host-scoped assessment-context profile, and Control is an identifier-unassigned independent root. Both separate control definition, execution and time-bounded effectiveness and reject inference from control existence or policy status.

Grok corrects the initial local synthesis: EM-RSK-02 is Audit, Review and Finding, not Risk Treatment. Treatment execution therefore remains an unowned gap rather than being delegated there. Grok also blocks a WM-ACT-034 control-assessment profile until a written occupancy crosswalk resolves WM-ACT-033 and WM-XCT-027 collisions. The reconciled candidate therefore keeps WM-ACT-034 reference-only and conditional, allocates no identifier and claims no publication readiness.

The frozen audit returned REVISE for 33 closed items. Revision 3 applies them once without audit rerun: pinned bases, lifecycle gates, time-bounded states, field-level mixin cuts, explicit gaps, comparability/time/evidence rules and concrete fixtures.

The frozen audit returned REVISE for 33 closed items. Revision 3 applies them once without audit rerun: pinned bases, lifecycle gates, time-bounded states, field-level mixin cuts, explicit gaps, comparability/time/evidence rules and concrete fixtures.