These cookies are required for the website to function properly. They ensure security, enable basic features like page navigation, and store user session data. You cannot disable these cookies.
- GRC Audit Compliance
- Data model
The tables behind GRC Audit Compliance
GRC Audit Compliance ships with 29 tables, grouped here by the feature that uses them. Every record your team works with lives in one of them, and you can add fields and tables in Proto.
- Tables
- 29
- Features
- 6, plus shared settings
- Change it
- Add fields and tables in Proto
How the model is organised
Organization and people
Program organizations, business units and control test staff support Assessments; Organizations, units counterparties and team members support assurance assessments.
Risk and controls
Risk scale register links to Controls; Risks links to scored risk controls. Each control has an owner and effective date.
Assessment work
Assessments links to evidence based test lines and Findings; assurance assessments links to assessment tests and control test findings.
Correction
Findings links to corrective actions and Retests; control test findings links to remediation tracking and corrective action retests.
Review and evidence
Review decisions and assurance reviews belong to Assessments. Source revision decisions and review revisions belong to assurance assessments. Each family has attachments and operation receipts.
Every table, by feature
- Assessment planning8
- Risks and controls8
- Control testing8
- Findings and remediation6
- Independent review6
- Evidence and operations6
- Shared and settings1
- Assessments
Audit and compliance assessments over a defined period and scope.
Linked to Program organizations, Control test staff, Business units - Assurance assessments
Planned and executed assurance assessments over a control scope and period.
Linked to Organizations, Team members, Units counterparties - Program organizations
Audited organizations holding the compliance program scope.
- Organizations
Audited organizations that own assessments, controls and evidence.
- Business units
Units in scope for assessments and risk registers.
Linked to Program organizations - Units counterparties
Auditable business units and counterparties inside an organization.
Linked to Organizations - Control test staff
Control owners, testers and independent assurance reviewers.
Linked to Program organizations, Users - Team members
Named assurance staff who own assessments, controls and reviews.
Linked to Organizations, Users
- Risk scale register
Risks scored on an explicit likelihood and impact scale version.
Linked to Business units, Control test staff - Risks
Scored risks that controls are designed to mitigate.
Linked to Units counterparties, Team members - Controls
Controls mitigating a risk, owned and effective from a date.
Linked to Risk scale register, Control test staff - Scored risk controls
Controls operating against scored risks, with owners and effective dates.
Linked to Risks, Team members - Business units
Units in scope for assessments and risk registers.
Linked to Program organizations - Units counterparties
Auditable business units and counterparties inside an organization.
Linked to Organizations - Control test staff
Control owners, testers and independent assurance reviewers.
Linked to Program organizations, Users - Team members
Named assurance staff who own assessments, controls and reviews.
Linked to Organizations, Users
- Evidence based test lines
Evidence-based control test lines executed under an assessment.
Linked to Assessments, Controls - Assessment tests
Individual control tests executed under an assessment, with sample and result.
Linked to Assurance assessments, Scored risk controls - Assessments
Audit and compliance assessments over a defined period and scope.
Linked to Program organizations, Control test staff, Business units - Assurance assessments
Planned and executed assurance assessments over a control scope and period.
Linked to Organizations, Team members, Units counterparties - Controls
Controls mitigating a risk, owned and effective from a date.
Linked to Risk scale register, Control test staff - Scored risk controls
Controls operating against scored risks, with owners and effective dates.
Linked to Risks, Team members - Record attachments
Evidence files attached to an assessment with visibility scope.
Linked to Assessments, Control test staff - Evidence uploads
Evidence files attached to an assessment with visibility and uploader.
Linked to Assurance assessments, Team members
- Findings
Assurance findings raised against a control and assessment.
Linked to Assessments, Controls - Control test findings
Findings raised from failed or inconclusive control tests.
Linked to Assurance assessments, Scored risk controls - Corrective actions
Remediation actions assigned to a finding owner.
Linked to Findings, Control test staff - Remediation tracking
Remediation actions assigned to findings, with due date and evidence.
Linked to Control test findings, Team members - Retests
Independent retest evidence that gates finding closure.
Linked to Findings, Control test staff - Corrective action retests
Independent retests that verify a corrective action and permit closure.
Linked to Control test findings, Team members
- Assurance reviews
Assurance review records submitted for independent sign-off.
Linked to Assessments, Program organizations - Review revisions
Assurance review revisions submitted for independent decision.
Linked to Assurance assessments, Organizations - Review decisions
Independent approve, reject or return decisions on an assessment revision.
Linked to Assessments, Control test staff - Source revision decisions
Independent reviewer decisions recorded against a source revision.
Linked to Assurance assessments, Team members - Assessments
Audit and compliance assessments over a defined period and scope.
Linked to Program organizations, Control test staff, Business units - Assurance assessments
Planned and executed assurance assessments over a control scope and period.
Linked to Organizations, Team members, Units counterparties
- Record attachments
Evidence files attached to an assessment with visibility scope.
Linked to Assessments, Control test staff - Evidence uploads
Evidence files attached to an assessment with visibility and uploader.
Linked to Assurance assessments, Team members - Idempotency receipts
Idempotent receipts for guarded operations keyed by Operation Key.
Linked to Assessments - Operation receipts
Durable receipts for guarded operations, with result state and effect references.
Linked to Assurance assessments - Assessments
Audit and compliance assessments over a defined period and scope.
Linked to Program organizations, Control test staff, Business units - Assurance assessments
Planned and executed assurance assessments over a control scope and period.
Linked to Organizations, Team members, Units counterparties
Keys and references
The assessment record number identifies the working case. The revision links a review decision to the version considered. Test lines reference their parent assessment and control; findings also reference both. Action and retest records refer to the finding. An operation key and expected revision identify a guarded action for reconciliation. Keep each parallel record family internally consistent when importing or linking data.
Migration order
- Import organizations, business units or counterparties, users and named staff.
- Import scored risks and their owners, then controls with effective dates.
- Import assessments with organization, unit, owner and period.
- Import test lines and evidence attachments under the right assessment family.
- Import findings, corrective actions and retests in their reference order.
- Import review records, decisions and operation receipts after their parent assessments.
Set up GRC Audit Compliance your way.
Start free, then use Proto to change fields, steps and approvals before your team goes live.