Most platforms generate risks from data. GRAC equips your risk function with signals — and lets the discipline lead.
Risk registers are static documents reviewed quarterly. They're decoupled from how controls actually run. KRIs are invented in isolation. Treatment plans aren't linked to specific controls. The board reads a register that's wrong by the time the meeting starts.
Strategic, emerging, geopolitical and reputational risks are missed entirely because the platform only sees what it can measure. The risk function ends up either a paper exercise or a downstream consumer of someone else's data.
Risk is a human judgment informed by evidence. GRAC provides the most comprehensive signal fabric available — Assurance Engine signals at Practice Instance granularity, third-party assessments, VAPT findings, incident records, dependency health, exceptions, maturity — and lets the risk function lead.
Full lifecycle: identify, assess, treat, monitor, communicate. Treatment plans link to specific Practice Instances that, once assured, address the risk. KRIs threshold against real Instance signals. The Three Lines of Defense becomes operational rather than aspirational.
Manual risk registration by risk officers and managers
Signal-driven candidate risks at Instance granularity, surfaced from across the platform: Assurance, VAPT, Third-party, Incident, Exception, Dependency, Maturity
External intelligence ingestion — regulatory updates, threat intelligence, peer incidents
Risk taxonomy — strategic, operational, financial, compliance, reputational, cyber, with custom domains
Inherent + residual + velocity scoring with likelihood, impact and crystallization speed
Risk appetite and tolerance configuration per domain, entity, or function
Heat maps, matrices, and multi-dimensional views
Risk aggregation across departments, entities, or domains
Treatment decision — accept, mitigate, transfer, avoid — with workflow and approvals
Treatment plans linked to specific Practice Instances that, once operationalized and assured, address the risk
Risk acceptance workflow with rationale, conditions, expiry and approval authority
Compensating controls where full mitigation isn't feasible
KRIs at Instance level — define, track, threshold against real operational signals
Risk lifecycle states — identified, assessed, under treatment, monitored, accepted, closed
Periodic re-evaluation cadence + trigger-based re-evaluation
Authoritative organizational risk register
Risk dashboards for officers, executive committee, and board risk committee
Auto-generated risk narratives from signals and assessments
Feeds into regulatory risk reporting where required
A living risk register fed by real operational signals — not a quarterly story.
Risk treatment auditable end-to-end — from risk to Practice Instance to evidence.
KRIs that actually move with operational reality.
Board risk reporting backed by signals, not narrative.
Risk function retains independence — GRAC informs judgment; it doesn't replace it.
Assurance, VAPT, Third-party, Incident, Exception, Dependency, Maturity — all feeding candidate risks.
Assurance is concurrent audit, not the sole source of truth.
Fully traceable in both directions.
| Spreadsheet register | Legacy GRC | Modern Compliance Tools | GRAC | |
|---|---|---|---|---|
| Update frequency | Quarterly review | Heavy, periodic | Risk is an afterthought | Continuous signal-fed |
| Treatment linkage | None | Manual notes | None | Linked to Practice Instances |
| KRI grounding | Invented in isolation | Manually defined | Limited | Thresholded against Instance signals |
| Discipline independence | N/A | Workflow-shaped | Engine-shaped | Discipline-led, signal-fed |
We'll show how a signal from the Assurance Engine surfaces as a candidate risk, gets treated via a Practice Instance, and closes with evidence — end-to-end.