Platform module · Governance, risk and compliance

Risk, control and audit on the assets that matter most.

Risks, controls, audits and obligations sit on the same assets as everything else, so each one carries the value of what it protects. The work goes first where the most value is at stake.

The core chain

Assetswhat you protect, with its Vi

Riskswhat could go wrong

Controlswhat keeps it from happening

Auditsproof that the controls work

Compliancewhat the rules require

One chain, one set of records

From the asset to the evidence, without copies.

Risk, internal control and internal audit usually keep their own lists. Here they work on one chain: a risk is raised on an asset, a control treats it, a test proves it, and a finding goes back to the owner.

01 · Risk

Register and treatment

Risks raised on real assets, assessed, treated and monitored, with owners and due dates.

02 · Controls

Library, tests, evidence

One control library mapped to risks and requirements. Design and effectiveness tests keep their evidence attached.

03 · Audit

Plans, findings, follow-up

Audit programmes built on the asset and control universe, findings tracked to closure as actions.

04 · Compliance

Regulations and obligations

Requirements from regulations and standards mapped once to controls, and reused for every audit that asks.

Value at risk

A severity score is not a priority.

A critical weakness on a test server and a moderate one on the payment gateway are not the same problem. Ranking by the value of the asset behind a weakness puts the effort where the business depends on it.

Prioritised by value

The score decides where governance effort goes.

Risk

Exposure in value terms

A risk on assets with a combined Vi of 805 in a portfolio of 15,000 touches 5.4% of organisational value. That share, not a colour, sets the treatment.

Controls

Test where it counts

Controls on Sustain and Invest assets are reviewed more often than those on assets heading for retirement.

Incidents

Loss sets the priority

When an asset fails, the value lost (ΔVi) sets the priority and the target time, from P1 to P5.

Example figures from the framework books. How value is measured →

Inside the module

What risk, control and audit teams work with.

Risk registerIdentification, assessment, treatment plans and monitoring on each asset.

Control library and testingControls mapped to risks and requirements, with test plans and results.

Evidence and documentsEvidence stored once, classified and linked to every control and audit it supports.

Audit programmesPlans, fieldwork, findings and follow-up, with actions handed to owners.

Regulations catalogueRegulations and standards broken into obligations, ready to map to controls.

Decisions and audit trailWho accepted which risk, who approved which exception, and every change to a record.

Maturity dimensions · from the core competencies of the framework

Risk Management · 6

IdentificationAssessmentTreatmentMonitoringReportingCulture

Compliance & Regulatory · 5

Regulatory mappingControl implementationEvidence collectionAudit managementCompliance monitoring

Cyber Security · 5

Asset protectionThreat managementVulnerability managementIncident responseAccess control

Part of one platform

The red line runs through the value engine.

GRC connects policies, risks, controls, audits, compliance and regulations. Every station it shares with the other lines is a record you only keep once.

With Enterprise Architecture