Same Practice. Many contexts. One coherent model.
GRAC's data model handles the operational reality that no conventional GRC tool has handled before: the same control running across multiple environments, locations, or business units — each with its own owner, evidence, and assurance mode.
Real organizations don't fit one control per requirement.
Conventional GRC tools model one control per framework requirement. But that's not how real organizations operate. A single requirement — 'enforce role-based access control' — exists in many places: in the cloud, on-premise, across HR systems, across branch banking systems, across SaaS applications. Each place has different owners. Different evidence locations. Different assurance modes. Different criticality.
Force-fitting all of that into one control loses operational truth. Splitting it into five controls loses regulatory traceability.
A Practice is the concept. A Practice Instance is the operation.
In GRAC, a Practice is a normalized template — the framework-agnostic concept of what the requirement means. A Practice Instance is the operational reality of how that Practice runs in a specific context.
A Practice does not run. A Practice Instance runs.
The same model. Three industries. Twelve Instances.
Example 1 — Multi-environment Access Control
In a typical enterprise, this Practice instantiates as multiple Instances:
Same Source Statement. Same Practice. Four Instances. Four owners. Four assurance regimes. One coherent compliance picture.
Example 2 — Multi-ward Hand Hygiene Compliance
In a hospital, this Practice instantiates as:
One Source Statement. One Practice. Four atomic Instances, each accountable, each assured at its appropriate cadence.
Example 3 — Multi-plant Machine Guard Inspection
In a manufacturing group:
Same ISO Practice. Four Instances across three plants. Corporate quality gets comparative analytics: which line, which shift, which plant has better guard-inspection completion?
Six architectural side effects. Each measurable.
See the Model in Action.
We'll walk through the Practice Instance Model with examples from your industry.