How mature is your GRC programme?

1. Governance

Are GRC roles, committees and reporting lines defined and documented?

2. Obligations

Do you keep one register of the regulations, standards and contracts you must comply with?

3. Risk

Is there one enterprise risk register with a common scoring method, reviewed more than once a year?

4. Controls

Is each control mapped to every framework it satisfies, so evidence is collected once?

5. Internal audit

Are audit findings tracked to closure with owners and due dates, without manual chasing?

6. Cybersecurity

Can you show current evidence for your national cybersecurity framework and ISO 27001 within a day?

7. Continuity

Has your BIA been updated and a continuity exercise run in the last 12 months?

8. Documents

Is there one controlled, current version of every policy and procedure, with approvals recorded?

9. Reporting

Are board and committee GRC reports produced from live data rather than rebuilt by hand?

10. Tools

Is most GRC work done in a dedicated system rather than spreadsheets and email?