Solution architecture
One governance architecture. Every critical risk conversation.
Risk, audit, compliance, resilience and intelligence on one shared data model.
01 / 06
Enterprise & Operational Risk
A register that moves when the business moves.
- COSO ERM
- ISO 31000
- Basel operational risk
- Risk appetite
A risk register is not a document; it is the organisation’s working model of its own exposure. That model is only useful if it is current, which means ownership at the point of work, indicators that watch thresholds between reviews, and appetite that triggers rather than describes.
The shift here is from an annual assessment that produces a report to a live register that produces escalations. Same objects, entirely different operating rhythm.
The lifecycle
- 1Define taxonomy, entity tree and appetite
- 2Identify and assess inherent exposure
- 3Map controls and test effectiveness
- 4Score residual risk and compare to appetite
- 5Monitor KRIs against thresholds
- 6Escalate, treat and re-assess continuously
Modules
Enterprise Risk Management
Enterprise Risk Management: DetailsThe register itself, hierarchical, owned, and rolled up from process to group without re-keying.
- Risk register
- Risk identification
- Inherent assessment
- Residual assessment
- Risk appetite
- Risk quantification
- Ownership
- Controls
- Action plans
- Escalations
- Dashboards
Risk register · Risk identification · Inherent assessment · Residual assessment · Risk appetite · Risk quantification · Ownership · Controls · Action plans · Escalations · Dashboards
Operational Risk Management
Operational Risk Management: DetailsRCSA, loss events and the operational indicators that tell you where process risk is concentrating.
- RCSA
- Operational registers
- Loss events
- KRIs
- Controls
- Action plans
- Monitoring
- Escalations
RCSA · Operational registers · Loss events · KRIs · Controls · Action plans · Monitoring · Escalations
Integrated Risk Management
Integrated Risk Management: DetailsThe consequence of the architecture: one view across risk, control, audit, compliance, incidents and third parties.
- Combined assurance map
- Cross-module dashboards
- Shared evidence store
- Role-based views
- Coverage gap analysis
Combined assurance map · Cross-module dashboards · Shared evidence store · Role-based views · Coverage gap analysis
Early Warning System
Early Warning System: DetailsDon’t wait for the risk event. Watch the signal, indicators with trigger levels and routed escalation.
- KRI library
- Thresholds
- Trend analysis
- Alerts
- Escalation routing
- Predictive indicators
KRI library · Thresholds · Trend analysis · Alerts · Escalation routing · Predictive indicators
What changes
- 70%less manual consolidation effort reported
- 1 viewgroup to entity, no reconciliation
- Triggeredescalation instead of discovered escalation
Where it connects
- Internal Audit shares the control library
- Incidents loss events feed the register
- TPRM vendor exposure as risk objects
- Hawk-i pattern and exception analysis
Start here
Most programmes begin by importing the existing register and taxonomy, then adding KRIs and appetite thresholds in the first cycle.
02 / 06
Audit & Assurance
From audit planning to closure, one connected lifecycle.
- IIA Standards
- Risk-based planning
- IFC / ICFR
- QAIP
Internal audit is the function most often asked to prove its own rigour. That is straightforward when the plan, the fieldwork, the evidence and the follow-up sit in one chain of custody, and painful when they sit across a planning spreadsheet, a shared drive and an email thread.
Risk-based planning is standard. What changes with a shared control library is that a test performed in audit is already evidence for IFC, ISO and the regulator, so assurance stops being re-performed by every reader who needs it.
The lifecycle
- 1Build the audit universe and score it against risk
- 2Approve the annual plan and allocate resource
- 3Execute fieldwork with programmes and sampling
- 4Agree findings and management actions
- 5Track remediation to closure with evidence
- 6Report to committee and feed the risk register
Modules
Internal Audit 360
Internal Audit 360: DetailsThe full lifecycle, universe to closure, across multiple entities on one methodology.
- Audit universe
- Risk-based planning
- Audit programs
- Checklists
- Sampling
- Fieldwork
- Findings
- Recommendations
- Action tracking
- Follow-up
- Reporting
- Analytics
- Multi-entity
Audit universe · Risk-based planning · Audit programs · Checklists · Sampling · Fieldwork · Findings · Recommendations · Action tracking · Follow-up · Reporting · Analytics · Multi-entity
Audit Management
Audit Management: DetailsResourcing, scheduling and quality review for the audit function itself.
- Resource planning
- Time tracking
- Review sign-off
- Working papers
- QAIP evidence
Resource planning · Time tracking · Review sign-off · Working papers · QAIP evidence
Internal Financial Controls
Internal Financial Controls: DetailsIFC and ICFR testing sequenced against statutory reporting timelines.
- Risk-control matrix
- Process narratives
- Design testing
- Operating effectiveness
- Deficiency evaluation
- Certification
- Audit trail
Risk-control matrix · Process narratives · Design testing · Operating effectiveness · Deficiency evaluation · Certification · Audit trail
Control Management
Control Management: DetailsThe shared control library every other capability draws on.
- Control library
- Control owners
- Test calendars
- Evidence vault
- Cross-framework mapping
Control library · Control owners · Test calendars · Evidence vault · Cross-framework mapping
What changes
- −62%audit cycle time in a live deployment
- 1,400+controls consolidated in one estate
- Two clicksfrom assertion to source evidence
Where it connects
- ERM findings update residual risk
- Compliance one test, several obligations
- ISO clause-level control reuse
- Hawk-i audit data analysis and drafting
Start here
Internal Audit 360 is the most common first deployment, it produces the control library the rest of the estate inherits.
03 / 06
Compliance & Governance
Obligations as objects, not as documents nobody re-reads.
- Obligation register
- Regulatory change
- Attestation
- ISO standards
Regulators publish faster than any function can read. Held as PDFs and summaries, an obligation register decays quietly: the circular is logged, the applicability assessment is informal, and nobody can say with confidence which control discharges which requirement.
Obligations become structured objects mapped to controls, owners and evidence, so regulatory change becomes an update to a register rather than a rebuild of a spreadsheet, and certification is assembly rather than archaeology.
The lifecycle
- 1Load the obligation register for your licences
- 2Assess applicability by entity and geography
- 3Map obligations to controls and owners
- 4Run the compliance calendar with evidence capture
- 5Assess regulatory change and implement
- 6Certify periodically with a complete trail
Modules
Compliance Management
Compliance Management: DetailsCentralised obligations, assessments and evidence, with regulator-ready reporting.
- Obligation library
- Compliance registers
- Assessments
- Evidence
- Control mapping
- Workflows
- Exceptions
- Remediation
- Reporting
Obligation library · Compliance registers · Assessments · Evidence · Control mapping · Workflows · Exceptions · Remediation · Reporting
Regulatory Compliance & Circular Management
Regulatory Compliance & Circular Management: DetailsTrack what changed, decide whether it applies, and prove you implemented it.
- Regulatory updates
- Circular tracking
- Applicability
- Obligation mapping
- Assignment
- Evidence
- Closure
Regulatory updates · Circular tracking · Applicability · Obligation mapping · Assignment · Evidence · Closure
Policy Management
Policy Management: DetailsThe policy estate, versioned, attested and checked against the regulation it answers to.
- Authoring
- Review
- Approval
- Versioning
- Distribution
- Acknowledgement
- Policy compliance
- Regulatory comparison
Authoring · Review · Approval · Versioning · Distribution · Acknowledgement · Policy compliance · Regulatory comparison
ISO Management
ISO Management: DetailsCertification maintained continuously rather than rebuilt before each surveillance audit.
- Clause mapping
- Statement of applicability
- Internal audit programme
- Non-conformity
- CAPA
- Management review
Clause mapping · Statement of applicability · Internal audit programme · Non-conformity · CAPA · Management review
What changes
- Same daycertification pack assembly
- 0 gapsunmapped obligations flagged automatically
- 41 secto gap-check a 148-page policy with Hawk-i
Where it connects
- Internal Audit shared control evidence
- Policy obligations cite the governing policy
- Hawk-i obligation extraction and comparison
- Cyber framework controls mapped once
Start here
Usually the obligation register plus circular management, with Hawk-i running gap analysis across the existing policy library.
04 / 06
Third-Party Risk Management
Your third party is part of your risk perimeter.
- RBI outsourcing directions
- DORA
- ISO 27036
- Criticality tiering
Outsourcing transfers activity, never accountability. Yet most vendor estates are governed by an onboarding questionnaire and an annual refresh, a cadence that made sense when suppliers were stable and shallow, and makes none when they are dynamic, nested and critical.
Continuous TPRM means depth and frequency proportionate to criticality: material arrangements monitored against SLAs, incidents and reassessment triggers, with exit plans that have actually been tested.
The lifecycle
- 1Onboard and classify criticality
- 2Run due diligence via the vendor portal
- 3Score, approve and contract with controls
- 4Monitor SLAs, incidents and vendor KRIs
- 5Reassess on a tier-driven cadence
- 6Remediate, review and evidence exit
Modules
Vendor Onboarding & Due Diligence
Vendor Onboarding & Due Diligence: DetailsConfigurable questionnaires by category, completed by the third party in their own portal.
- Vendor portal
- Questionnaires
- Document collection
- Scoring
- Approval gates
- Vendor classification
Vendor portal · Questionnaires · Document collection · Scoring · Approval gates · Vendor classification
Assessment & Contracting
Assessment & Contracting: DetailsSecurity, compliance and financial assessment feeding the contractual control set.
- Security assessment
- Compliance assessment
- Financial assessment
- Contractual controls
- SLA definition
Security assessment · Compliance assessment · Financial assessment · Contractual controls · SLA definition
Continuous Control Monitoring
Continuous Control Monitoring: DetailsBetween-review visibility: performance, incidents and indicators against the tier.
- Vendor KRIs
- SLA monitoring
- Incident linkage
- Reassessment triggers
- Performance reviews
Vendor KRIs · SLA monitoring · Incident linkage · Reassessment triggers · Performance reviews
Remediation & Offboarding
Remediation & Offboarding: DetailsClose the gaps, and prove the exit plan works before you need it.
- Remediation tracking
- Exit plans
- Exit testing
- Data return evidence
- Offboarding checklist
Remediation tracking · Exit plans · Exit testing · Data return evidence · Offboarding checklist
What changes
- 320vendors tiered in one deployment
- Autoreassessment triggered by tier
- Audit-readyevidence pack per relationship
Where it connects
- ERM concentration and vendor risk objects
- Cyber third-party cyber assessment
- BCM third-party resilience dependencies
- Incidents vendor-caused events
Start here
Tier the estate first, most clients find a third of “critical” vendors are not, and a handful of unclassified ones are.
05 / 06
Incident & Resilience
Plans are judged by their test evidence, not their existence.
- ISO 22301
- BIA / RTO / RPO
- Root cause analysis
- Whistleblower protection
Every organisation has a continuity plan. Far fewer can show when it was last exercised, what failed during the exercise, and who closed the gap. Incidents tell the same story: recorded diligently, aggregated rarely, and almost never fed back into the register they should be updating.
Treat continuity, incidents, fraud and whistleblowing as one evidence chain, intake, investigation, root cause, corrective action, closure, and resilience becomes demonstrable rather than asserted.
The lifecycle
- 1Capture the event through any channel
- 2Classify, assess impact and escalate
- 3Investigate and establish root cause
- 4Raise corrective and preventive actions
- 5Close with evidence and audit trail
- 6Feed findings back into risk and controls
Modules
Incident Management
Incident Management: DetailsMulti-channel intake into one repository, with investigation and RCA held against the event.
- Incident submission
- Multiple channels
- Central repository
- Investigation
- Impact analysis
- RCA
- Corrective actions
- Escalation
- Closure
- Audit trail
- Analytics
Incident submission · Multiple channels · Central repository · Investigation · Impact analysis · RCA · Corrective actions · Escalation · Closure · Audit trail · Analytics
Fraud Risk Management
Fraud Risk Management: DetailsFraud as a specialised path through the same chain, event to control failure to monitoring.
- Fraud risk assessment
- Investigation
- Impact
- RCA
- Control failure linkage
- Action tracking
- Monitoring
Fraud risk assessment · Investigation · Impact · RCA · Control failure linkage · Action tracking · Monitoring
Whistleblower Management
Whistleblower Management: DetailsConfidential reporting with protected workflows and an unbroken trail.
- Secure reporting
- Anonymity options
- Confidential workflows
- Investigation
- Escalation
- Resolution
- Audit trail
Secure reporting · Anonymity options · Confidential workflows · Investigation · Escalation · Resolution · Audit trail
Business Continuity Management
Business Continuity Management: DetailsBIA, recovery strategies and a test calendar that produces evidence.
- Business impact analysis
- Critical processes
- RTO / RPO
- Continuity planning
- Scenario testing
- Recovery
- Third-party resilience
- Review
Business impact analysis · Critical processes · RTO / RPO · Continuity planning · Scenario testing · Recovery · Third-party resilience · Review
What changes
- Evidencedresilience for ISO 22301 audits
- Aggregatedincidents become enterprise risk signals
- Trackedevery post-exercise gap to closure
Where it connects
- ERM loss events and near misses
- TPRM vendor dependency mapping
- Internal Audit control failure evidence
- Cyber cyber incident pathway
Start here
Incident management first, it generates the operational evidence most enterprise registers are missing.
06 / 06
Technology & Cyber Risk
Cyber risk the board can rank against everything else.
- ISO 27001
- NIST CSF
- CIS Controls
- Cyber incident reporting
Security risk assessed on its own scale cannot be compared with credit, conduct or operational risk, so it reaches the board as a technical report rather than a governance decision, and competes for investment without a common denominator.
Assess technology and information risk on the same taxonomy as the rest of the business, map controls across frameworks once, and route vulnerabilities and cyber incidents through the same accountability chain as any other failure.
The lifecycle
- 1Register assets, threats and applicable controls
- 2Assess technology and information risk
- 3Map controls across frameworks once
- 4Ingest vulnerabilities and assign remediation
- 5Manage cyber incidents with notification clocks
- 6Report posture to board and regulator
Modules
Cybersecurity Risk Management
Cybersecurity Risk Management: DetailsCyber registers, control frameworks and posture reporting in business language.
- Cyber risk register
- Cyber controls
- Framework mapping
- Compliance frameworks
- Remediation
- Risk dashboards
Cyber risk register · Cyber controls · Framework mapping · Compliance frameworks · Remediation · Risk dashboards
Vulnerability Management
Vulnerability Management: DetailsVAPT findings turned into owned, SLA-tracked remediation rather than a report.
- Vulnerability identification
- VAPT intake
- Risk classification
- Ownership
- SLA tracking
- Escalation
- Closure
Vulnerability identification · VAPT intake · Risk classification · Ownership · SLA tracking · Escalation · Closure
IT Risk Management
IT Risk Management: DetailsApplication, infrastructure and technology risk with IT controls and compliance.
- Technology risk
- Application risk
- Infrastructure risk
- IT controls
- IT compliance
- Risk assessment
Technology risk · Application risk · Infrastructure risk · IT controls · IT compliance · Risk assessment
Cyber Incident Management
Cyber Incident Management: DetailsDetection-to-closure with regulatory notification timelines built in.
- Incident ingestion
- SIEM / SOAR integration
- Investigation
- RCA
- Corrective actions
- Notification clocks
- Escalation
Incident ingestion · SIEM / SOAR integration · Investigation · RCA · Corrective actions · Notification clocks · Escalation
What changes
- One testsatisfies ISO, IFC and audit
- Clock-awareregulatory notification timelines
- Rankedcyber risk alongside business risk
Where it connects
- ERM same taxonomy and appetite
- TPRM third-party cyber exposure
- ISO Annex A control reuse
- Incidents shared investigation chain
Start here
Cyber risk register plus vulnerability management, with framework cross-mapping so existing tests are not repeated.
Shared foundation
The second capability should cost less than the first.
Usually it costs more: a new taxonomy, new owners, another migration. That is the tax a shared architecture removes.
- 01Risk taxonomy
- 02Entity hierarchy
- 03Control library
- 04Obligation register
- 05Evidence vault
- 06Workflow engine (Flexy)
- 07RBAC & SSO
- 08Immutable audit trail
- 09Dashboards
- 10Notifications
- 11REST API
- 12Hawk-i intelligence
Bring your risk register. We’ll test the architecture on it.
45 minutes with a practitioner who has run these programmes, not a scripted product tour.
Request a demo