Free trial

Module

GRC

Every control, with the evidence that holds it up

Governance, risk and compliance stop living in a spreadsheet someone updates the week before the audit.

Start a proof of concept

The problem

Declared compliance is not compliance

A percentage that comes out of a self-assessment does not survive an inspection. What survives is an assessed control, with dated evidence and the signature of whoever approved it.

Capabilities

Six capabilities, six artefacts

Every capability ends in something you can put in front of an auditor: a document, a dated status or a signature.

  • Scope by unit

    Which frameworks apply to which part of the organisation. A group with subsidiaries does not assess the same thing everywhere.

    Artefact: 13 frameworks out of the box

  • Statement of applicability

    Control by control, what applies and what does not, with the justification for each exclusion. Publishable as an SoA.

    Artefact: Published SoA

  • Evidence per control

    The real state of each control is tied to the document that backs it, to the findings that affect it and to the person who approved it.

    Artefact: Evidence per control

  • Gaps and maturity

    Open gaps and maturity measured over controls actually assessed, with the denominator in plain sight.

    Artefact: Gap map

  • Risks and exceptions

    A risk register measured against a stated appetite. Exceptions are approved by someone else and expire on a fixed date.

    Artefact: Exception with an expiry

  • Attestation campaigns

    The control owner signs it off in every campaign. The position report for the board comes straight out of that.

    Artefact: Attested control

Conformity by framework, measured over the controls assessed, not over the declared total. Demonstration data.
Conformity by framework, measured over the controls assessed, not over the declared total. Demonstration data.

The platform

The other modules

They switch on separately. They share the foundation, so adding one more means migrating nothing.

Proof of concept

Try it on your own audits

We stand up an environment with your real scope, your findings and your frameworks. No cost, no card, no commitment to continue.

Start a proof of concept Talk to the team
  • Dedicated, isolated environment, ready in 48 hours
  • We import your scanner results and your history
  • Technical support for the whole trial