5 capabilities
Resilience & Conduct
What happens when a risk materialises, and the conduct obligations around it
The problem
Continuity plans, vendor assessments and conduct registers tend to be produced for an audit and then left. The test is never run, the vendor is never re-assessed, the loss event is recorded in an email. When something actually happens, the plan is out of date and nobody can find the version that was approved.
How it works
Business Continuity
Business impact analysis, recovery strategies, continuity plans, exercise tests and live invocation
- Business impact analysis sets recovery time objectives and criticality per process
- Recovery strategies are held against the impact analysis that justified them, with implementation status tracked
- Exercises record type, status and result, so an untested plan is visibly untested
- Invocation is first-class: declare an event, keep a timeline, attach evidence as it happens, and stand down, which means the post-incident review has a record instead of recollections
Third-Party Risk
Vendor register with risk tiering, due-diligence assessments and ongoing monitoring
- A vendor register with risk tiering, so due-diligence depth matches exposure
- Assessments are dated and re-assessment is scheduled rather than ad hoc
- Vendor risk connects to the register and the findings that concern them
Loss Events
Operational loss and near-miss capture, linked back to the risk that produced it
- Events are categorised against Basel event categories and a causal category, which is what makes the history analysable
- Gross amount, recoveries and recovery type are captured separately, so net loss is derived rather than asserted
- Near misses are recorded alongside actual losses, because the near miss is the cheaper lesson
- Boundary type distinguishes events that straddle risk categories, which is where operational loss data usually goes wrong
Risk Correlations & Scenarios
Causal links between risks, and modelled scenarios that traverse them
- Causal links between risks are modelled explicitly rather than implied by a heat map
- Scenarios traverse those links, so you can express how one failure propagates
Ethics & Speak-Up
Confidential whistleblower cases, conflict-of-interest declarations and an interest register
- Interest declarations and conflict-of-interest registers are maintained per person, with a declaration cycle
- Speak-up cases are handled confidentially, separately from the general case queue
What it produces when someone asks for proof
Continuity plans with recovery objectives, tested and with results recorded
A vendor register with risk tiering and dated due-diligence assessments
A loss event history categorised so it can be analysed rather than only counted
A conflict-of-interest and speak-up register with confidentiality preserved
The rest of the platform
GRC
6The risk register, the obligations that bind it, and the controls that answer them
Internal Audit
6The full engagement lifecycle, from a risk-based plan to a closed finding
Intelligence & Monitoring
7Continuous assurance over live operational data, not a point-in-time sample
Workflow & Governance
7How work gets routed, approved and proven across every module
Reporting & Analytics
3What the work produces, for the people who have to act on it
Want this mapped against your terms of reference? We will go through it line by line, and tell you plainly where it does not yet reach.
Request a demo