6 capabilities
GRC
The risk register, the obligations that bind it, and the controls that answer them
The problem
Most organisations can produce a risk register and a compliance checklist. Far fewer can show the line between them: which control answers which obligation, who assessed it, on what evidence, and when it is next due. That line is what an external auditor follows, and it is usually the thing that lives in someone's spreadsheet.
How it works
Risk Register & Assessment
Inherent and residual scoring on a 5×5 matrix, control mapping, treatment decisions and assessment history
- Inherent and residual positions scored separately on a 5x5 impact and likelihood matrix, so the effect of controls is visible rather than assumed
- Each risk maps to the controls that mitigate it, with an effectiveness rating on the link itself
- A treatment decision (accept, mitigate, transfer or avoid) is recorded against the risk, with the action plan attached where the decision is to mitigate
- Assessment history is retained, so you can show how a risk position moved and who moved it
Risk Appetite & KRIs
Board-set appetite statements with tolerance thresholds, and key risk indicators that breach against them
- Appetite statements set at board level with tolerance thresholds beneath them
- Key risk indicators carry a direction and green, amber and red thresholds, because for some indicators a rising number is the bad news and for others it is the reverse
- Crossing the red threshold raises an alert against the risk rather than sitting in a report nobody opened
Compliance Frameworks
Clause-level obligation libraries with evidenced control assessments and a clause-to-control crosswalk
- Frameworks decompose into control families and clause-level control items, each scored Met, Partial, Gap, Accepted or Not assessed
- An assessment records the assessor, the conclusion, the evidence behind it and the next review date, and supersedes the previous one rather than overwriting history
- A clause to control crosswalk means a control you already operate answers every obligation it satisfies, across frameworks
- Submission packs assemble defined sections for a named audience on a cadence, with last generated and next due tracked
Policies & Procedures
Lifecycle, versioning, diffs, approval routing, acknowledgement tracking and RACI procedure steps
- Full lifecycle from draft through review and approval to published, with scheduled re-review
- Version history with diffs between any two versions, so an approver can see exactly what changed
- Procedures nest under their parent policy, and procedure steps carry RACI assignments that can link to the control they implement
- Acknowledgement is tracked per reader, which is the difference between publishing a policy and being able to show it was received
Control Self-Assessment
Distributed questionnaires with scheduled reminders, aggregated scoring and comparison to the audit view
- Questionnaires built once and distributed to specific departments, units or named respondents
- Automated reminders for outstanding and overdue responses, on a schedule you set
- Responses aggregate across respondents and periods, and sit alongside the auditor's own assessment of the same control
Control Testing
Recurring test plans with executions, evidence and design-versus-operating effectiveness conclusions
- Recurring test plans with executions recorded against them, each carrying its evidence
- Conclusions separate design effectiveness from operating effectiveness, because a well designed control that is not operating is a different finding
- A failed test can promote into the audit record rather than being re-typed as a finding
What it produces when someone asks for proof
A risk register with inherent and residual positions and a recorded treatment decision per risk
Clause-level control assessments carrying the assessor, the conclusion and the supporting document
A crosswalk showing one control satisfying obligations in several frameworks at once
A time-bound exception register for everything knowingly accepted
The rest of the platform
Internal Audit
6The full engagement lifecycle, from a risk-based plan to a closed finding
Resilience & Conduct
5What happens when a risk materialises, and the conduct obligations around it
Intelligence & Monitoring
7Continuous assurance over live operational data, not a point-in-time sample
Workflow & Governance
7How work gets routed, approved and proven across every module
Reporting & Analytics
3What the work produces, for the people who have to act on it
Want this mapped against your terms of reference? We will go through it line by line, and tell you plainly where it does not yet reach.
Request a demo