GRC, risk, compliance and legal
Purpose and map of the area
Section titled “Purpose and map of the area”This area covers governance, risk, compliance and legal matters. It consists of four linked hubs: GRC (policies, controls, audits, findings), Compliance (obligations, evidence, attestations), Risk (risk register with structured methodologies) and Legal (legal matters and documents). It covers the types GRC-*, IT-RISK, IT-POLICY, IT-CONTROL, IT-AUDIT-FINDING and the legal entities.
What it is for. It is the GRC dashboard (Governance, Risk & Compliance): governance of policies, controls, audits and findings mapped to regulatory frameworks.
When to use it. For the overall view of the GRC programme and access to its objects.
How to open it. From the Home / Security Hub (GRC tile).
What it shows and how to use it. The GRC dashboard with the objects GRC-POLICY (lifecycle: draft→review→approval→publication→update→retirement, with attestation), GRC-CONTROL (controls mapped to frameworks: status, evidence, tests), GRC-AUDIT (planning, execution, finding review, report) and GRC-FINDING (severity, remediation owner, tracking until closure/risk acceptance).
What happens next. Published policies require attestation; open findings drive remediation.
Notes. Supported frameworks include ISO 27001, NIS2, SOC2, GDPR.
Compliance & Governance
Section titled “Compliance & Governance”What it is for. It manages compliance controls mapped to frameworks, with compliance status, evidence and periodic tests.
When to use it. To manage the control framework and check compliance.
How to open it. From the GRC area / Legal Hub.
What it shows and how to use it. The list of controls per framework with status, evidence and test dates.
What happens next. Non-compliant controls generate findings/actions.
Notes. Complements the Compliance Workspace (Compliance Workspace).
Compliance Hub
Section titled “Compliance Hub”What it is for. It is the entry point to the corporate compliance module, which reuses the HR campaign engine (with the module tag) for obligations, controls, evidence and attestations.
When to use it. To choose the compliance work area.
How to open it. From the Home / Security Hub (Compliance tile).
What it shows and how to use it. The tiles for the views of the Compliance Workspace (Compliance Workspace).
What happens next. The chosen view opens.
Notes. Core module that shares the campaign engine with HR.
Compliance Workspace
Section titled “Compliance Workspace”What it is for. It is the compliance work console, organised in views.
When to use it. To manage obligations, controls, evidence, audits, privacy and attestations.
How to open it. From the Compliance Hub (tiles).
What it shows. The available views:
| View | Content |
|---|---|
board |
Compliance summary dashboard |
adempimenti |
Obligations and deadlines |
controls |
Compliance controls |
ccm |
Continuous Controls Monitoring |
evidence |
Collected evidence |
gap |
Gap analysis |
audit |
Compliance audits |
incidents |
Compliance incidents |
risk |
Compliance risks |
privacy |
Privacy / GDPR |
m231 |
Model 231 (Italian Legislative Decree 231/2001) |
cra |
Cyber Resilience Act |
esg |
ESG (sustainability) |
regwatch |
Regulatory monitoring |
suppliers |
Supplier compliance |
training |
Compliance training |
catalog |
Catalogue of obligations/requirements |
aigov / aiasst |
AI Governance and AI assistant |
How to use it. You select the view; each view offers its own lists, details and actions (creating obligations, collecting evidence, starting attestation campaigns, gap analysis). Attestation campaigns require a read-and-acknowledge signature.
What happens next. Obligations and evidence feed the compliance status; campaigns generate the signature requests.
Notes. The campaign engine is shared with the HR Hub.
Risk Management Hub
Section titled “Risk Management Hub”What it is for. It is the entry point to risk management.
When to use it. To reach the register, cockpit and risk analysis tools.
How to open it. From the Home / Security Hub (Risk tile).
What it shows and how to use it. The tiles for Risk Cockpit and Risk Register (and the bowtie/FAIR/entity/crosswalk tools).
What happens next. The chosen tool opens.
Notes. Covers IT-RISK and GRC risks.
Enterprise Risk Register
Section titled “Enterprise Risk Register”What it is for. It is the enterprise risk register: the catalogue of risks with assessment and treatment.
When to use it. To record, assess and monitor risks.
How to open it. From the Risk Hub, Register tile.
What it shows. The list of risks with likelihood, impact, calculated score and treatment plan (Accept/Mitigate/Transfer/Avoid), owner and review date; a heat map (likelihood × impact) and exposure by category.
How to use it. You create/assess a risk, assign the treatment and the owner, and schedule the review.
What happens next. High risks drive mitigation actions and management decisions (Risk Cockpit).
Notes. The score is calculated as likelihood × impact.
Risk Cockpit
Section titled “Risk Cockpit”What it is for. It is the management view of risk: a summary for senior management.
When to use it. For strategic monitoring of the risk profile.
How to open it. From the Risk Hub, Cockpit tile.
What it shows and how to use it. Aggregated risk KPIs, trends and main risks, with drill-down.
What happens next. It guides management decisions on risk.
Notes. Reserved for management roles (see Cockpits and management views).
Risk Bowtie
Section titled “Risk Bowtie”What it is for. It runs the bow-tie analysis: causes → event → consequences, with preventive and reactive barriers.
When to use it. To analyse a risk in depth and design the barriers.
How to open it. From the Risk Hub / from the register.
What it shows and how to use it. The bow-tie diagram with causes, central event, consequences and barriers; you model the elements.
What happens next. The barriers become controls/actions to track.
Notes. Structured qualitative methodology.
Risk FAIR
Section titled “Risk FAIR”What it is for. It runs the FAIR quantitative analysis (Factor Analysis of Information Risk): an economic estimate of risk.
When to use it. To quantify a risk’s exposure in monetary terms.
How to open it. From the Risk Hub / from the register.
What it shows and how to use it. The FAIR factors (frequency, magnitude) and the estimated loss distribution.
What happens next. The quantification supports treatment and insurance decisions.
Notes. Quantitative methodology.
Risk Entity
Section titled “Risk Entity”What it is for. It manages risk entities (the objects/assets/processes that risks refer to).
When to use it. To link risks to their reference entities.
How to open it. From the Risk Hub.
What it shows and how to use it. The entities with their associated risks.
What happens next. It improves risk↔entity traceability.
Notes. Complements the register.
Compliance Crosswalk
Section titled “Compliance Crosswalk”What it is for. It is the crosswalk that maps risks/controls to the different compliance frameworks (correspondences between standards).
When to use it. To reuse a control across several frameworks and avoid duplication.
How to open it. From the Risk Hub / Compliance area.
What it shows and how to use it. The correspondence matrix between controls and the requirements of the various frameworks.
What happens next. It reduces multi-framework compliance effort.
Notes. It links Risk and Compliance.
Legal Hub
Section titled “Legal Hub”What it is for. It is the entry point to the legal area: matters, contracts, consents, DSARs, legal holds, electronic signature.
When to use it. To reach the legal tools.
How to open it. From the Home / Security Hub (Legal tile).
What it shows and how to use it. The tiles for Legal Cockpit, the legal entities (by category), contracts, the KB, the report builder, and the links to GRC/Risk/PSA.
What happens next. The chosen tool opens.
Legal Entity
Section titled “Legal Entity”What it is for. It manages legal entities by category.
When to use it. To work on matters, consents, DSARs, legal holds and signature envelopes.
How to open it. From the Legal Hub, tiles by category.
What it shows. The entities by category:
| Category | Content |
|---|---|
matter |
Legal matter/litigation |
legal_intake |
Intake of legal requests |
dsar_request |
DSAR requests (data subject rights, GDPR) |
consent_record |
Consent register |
legal_hold |
Legal holds (document retention) |
esign_envelope |
Electronic signature envelopes |
How to use it. You select the category and manage its entities (creation, progress, signature).
What happens next. Matters follow their course; signature envelopes trigger electronic signature.
Notes. Document management uses the legal collections.
Legal Cockpit
Section titled “Legal Cockpit”What it is for. It is the legal management view: a summary of matters and indicators.
When to use it. To oversee the legal area.
How to open it. From the Legal Hub, Cockpit tile.
What it shows and how to use it. Legal KPIs (open matters, deadlines, exposure) with drill-down.
What happens next. It guides the legal area’s priorities.
Notes. Reserved for legal/management roles.
Records Management
Section titled “Records Management”What it is for. It governs record retention (document and generic records) according to retention policies.
When to use it. To manage records subject to retention and legal holds.
How to open it. From the Legal Hub / Builder.
What it shows and how to use it. The records with their retention class and status; generic records can be entities built with the Builder (Administration).
What happens next. Records are kept/deleted according to the rules; legal holds block their deletion.
Notes. Linked to legal hold (Legal Entity).
Collections (risk-collections, legal-collections)
Section titled “Collections (risk-collections, legal-collections)”What it is for. They manage the document collections of the Risk and Legal domains (collections of documents/evidence).
When to use it. To organise and view the documents linked to risks and legal matters.
How to open it. From the Risk/Legal pages.
What it shows and how to use it. The collections with their documents; opening in the viewer/signature tool.
What happens next. The documents feed evidence and matters.
Notes. They reuse the attachment viewer and document signature.