{
  "title": "Sandbox Control Interview (Practice Scenario)",
  "description": "A de-identified practice run of the Business Unit Risk & Control Interview, built around a fictional company, so a trial user can see the full flow without running a real control interview before procurement or InfoSec review.",
  "language": "en",
  "questions": [
    {
      "hint": "Example answer: \"The AP team can override a three-way match failure with a single manager approval — no dual sign-off required.\"",
      "text": "At Meridian Distribution Co., walk through a control that relies on a manual override. How often is it used, and who approves it?",
      "type": "text",
      "order": 1,
      "required": true
    },
    {
      "hint": "Example answer: \"Our regional controller can both create and approve journal entries above $10k in the ERP.\"",
      "text": "Is there a task or system access at Meridian where one person can both initiate and approve the same transaction?",
      "type": "text",
      "order": 2,
      "required": true
    },
    {
      "hint": "Example answer: \"Vendor onboarding requires a second approver, but it's routinely skipped for 'urgent' requests.\"",
      "text": "What's one control at Meridian that exists on paper but isn't consistently followed in practice?",
      "type": "text",
      "order": 3,
      "required": true
    },
    {
      "hint": "Example answer: \"IT grants temporary admin access for outages, but there's no ticket or log tracking when it's revoked.\"",
      "text": "How does Meridian's team handle a case that falls outside the standard process? Is that exception path documented?",
      "type": "text",
      "order": 4,
      "required": true
    },
    {
      "hint": "Example answer: \"A duplicate payment was caught by accident, not by a control — it was never logged as an incident.\"",
      "text": "Has a control gap or near-miss happened at Meridian in the last 12 months that wasn't escalated formally?",
      "type": "text",
      "order": 5,
      "required": true
    },
    {
      "text": "How confident would you be that Meridian's controls hold up under a surprise external audit?",
      "type": "rating_scale",
      "order": 6,
      "options": {
        "max": 5,
        "min": 1,
        "maxLabel": "Very confident",
        "minLabel": "Not confident"
      },
      "required": true
    },
    {
      "text": "Anything else about Meridian's operations you'd flag, fictional or not?",
      "type": "text",
      "order": 7,
      "required": false
    }
  ]
}