These cookies are required for the website to function properly. They ensure security, enable basic features like page navigation, and store user session data. You cannot disable these cookies.
- GRC for Banking and Financial Services
- Data model and import order
The tables behind GRC for Banking and Financial Services
GRC for Banking and Financial Services ships with 15 tables, grouped here by the feature that uses them. Every record your team works with lives in one of them, and you can add fields and tables in Proto.
- Tables
- 15
- Features
- 7, plus shared settings
- Change it
- Add fields and tables in Proto
How the model is organised
Assessment planning:
Assessments, Organizations, business units, team members.
Risk and control register:
Risks, Controls, business units, team members.
Control testing:
Assessment tests, Assessments, Controls.
Findings and remediation:
Findings, corrective actions, Retests.
Assurance review:
Prudential control reviews, review decisions, Assessments.
Evidence and operations:
Record attachments, operation receipts, Users.
Every table, by feature
- Assessment planning5
- Risk and control register5
- Control testing5
- Findings and remediation6
- Independent retests5
- Assurance review5
- Evidence and operations5
- Shared and settings1
- Assessments
Scoped assessment engagements driven through a status lifecycle.
Linked to Organizations, Team members, Business units - Assessment tests
Individual control tests executed under an assessment.
Linked to Assessments, Controls - Organizations
Legal and operating organizations governed by this workspace.
- Business units
Operating units and counterparties that assessments and risks attach to.
Linked to Organizations - Team members
Named people who own, prepare and independently review work.
Linked to Organizations, Users
- Risks
Risks held against a business unit on an explicit likelihood and impact scale.
Linked to Business units, Team members - Controls
Controls that mitigate a risk and are executed by a named owner.
Linked to Risks, Team members - Business units
Operating units and counterparties that assessments and risks attach to.
Linked to Organizations - Team members
Named people who own, prepare and independently review work.
Linked to Organizations, Users - Assessment tests
Individual control tests executed under an assessment.
Linked to Assessments, Controls
- Assessment tests
Individual control tests executed under an assessment.
Linked to Assessments, Controls - Assessments
Scoped assessment engagements driven through a status lifecycle.
Linked to Organizations, Team members, Business units - Controls
Controls that mitigate a risk and are executed by a named owner.
Linked to Risks, Team members - Findings
Findings raised from failed or inconclusive control testing.
Linked to Assessments, Controls - Record attachments
Evidence files attached to an assessment with a visibility scope.
Linked to Assessments, Team members
- Findings
Findings raised from failed or inconclusive control testing.
Linked to Assessments, Controls - Corrective actions
Remediation actions assigned to a finding owner with due dates and evidence.
Linked to Findings, Team members - Assessment tests
Individual control tests executed under an assessment.
Linked to Assessments, Controls - Retests
Independent retests that decide whether a finding may be closed.
Linked to Findings, Team members - Assessments
Scoped assessment engagements driven through a status lifecycle.
Linked to Organizations, Team members, Business units - Controls
Controls that mitigate a risk and are executed by a named owner.
Linked to Risks, Team members
- Retests
Independent retests that decide whether a finding may be closed.
Linked to Findings, Team members - Findings
Findings raised from failed or inconclusive control testing.
Linked to Assessments, Controls - Corrective actions
Remediation actions assigned to a finding owner with due dates and evidence.
Linked to Findings, Team members - Team members
Named people who own, prepare and independently review work.
Linked to Organizations, Users - Assessment tests
Individual control tests executed under an assessment.
Linked to Assessments, Controls
- Prudential control reviews
Prudential control reviews covering regulator references and control areas.
Linked to Assessments, Organizations - Review decisions
Independent reviewer decisions recorded against an assessment revision.
Linked to Assessments, Team members - Assessments
Scoped assessment engagements driven through a status lifecycle.
Linked to Organizations, Team members, Business units - Assessment tests
Individual control tests executed under an assessment.
Linked to Assessments, Controls - Findings
Findings raised from failed or inconclusive control testing.
Linked to Assessments, Controls
- Record attachments
Evidence files attached to an assessment with a visibility scope.
Linked to Assessments, Team members - Operation receipts
Idempotent execution receipts for guarded operations on assessments.
Linked to Assessments - Assessments
Scoped assessment engagements driven through a status lifecycle.
Linked to Organizations, Team members, Business units - Assessment tests
Individual control tests executed under an assessment.
Linked to Assessments, Controls - Review decisions
Independent reviewer decisions recorded against an assessment revision.
Linked to Assessments, Team members
Keys and references
Keep source identifiers stable when importing organizations, units, people, risks and controls. A control references its risk; a test references both assessment and control. A finding references the same assessment and control behind its failed or inconclusive test. A corrective action and each retest reference the finding. Review decisions and operation receipts reference an assessment and identify the source revision or expected revision that mattered.
Migration order
- Load Organizations and Users, then team members and business units with their references.
- Load Risks and Controls with owners, scale versions, status and effective dates.
- Load Assessments for the intended periods, then their assessment tests and record attachments.
- Load Findings, corrective actions and Retests with their source links.
- Load prudential control reviews, review decisions and operation receipts; reconcile results with source records.
Set up GRC for Banking and Financial Services your way.
Start free, then use Proto to change fields, steps and approvals before your team goes live.