These cookies are required for the website to function properly. They ensure security, enable basic features like page navigation, and store user session data. You cannot disable these cookies.
- GRC for Education and Universities
- Data model
The tables behind GRC for Education and Universities
GRC for Education and Universities ships with 15 tables, grouped here by the feature that uses them. Every record your team works with lives in one of them, and you can add fields and tables in Proto.
- Tables
- 15
- Features
- 6, plus shared settings
- Change it
- Add fields and tables in Proto
How the model is organised
Organization and people
Organizations, business units, team members and Users identify the institution, its units and its people.
Risks and controls
Risks attach to business units; Controls attach to risks and named owners.
Assessment work
Assessments contain assessment tests and campus control reviews, with record attachments and operation receipts retained against the assessment.
Issues and decisions
Findings connect to assessments and controls; corrective actions and Retests attach to findings. Review decisions attach to assessments.
Every table, by feature
- Risk and control register5
- Assessment planning6
- Control testing5
- Campus reviews5
- Findings and remediation6
- Independent assurance7
- Shared and settings1
- Risks
Risks held against a business unit on an explicit likelihood and impact scale.
Linked to Business units, Team members - Controls
Controls that mitigate a risk and are executed by a named owner.
Linked to Risks, Team members - Business units
Operating units and counterparties that assessments and risks attach to.
Linked to Organizations - Organizations
Legal and operating organizations governed by this workspace.
- Team members
Named people who own, prepare and independently review work.
Linked to Organizations, Users
- Assessments
Scoped assessment engagements driven through a status lifecycle.
Linked to Organizations, Team members, Business units - Assessment tests
Individual control tests executed under an assessment.
Linked to Assessments, Controls - Controls
Controls that mitigate a risk and are executed by a named owner.
Linked to Risks, Team members - Organizations
Legal and operating organizations governed by this workspace.
- Business units
Operating units and counterparties that assessments and risks attach to.
Linked to Organizations - Team members
Named people who own, prepare and independently review work.
Linked to Organizations, Users
- Assessment tests
Individual control tests executed under an assessment.
Linked to Assessments, Controls - Assessments
Scoped assessment engagements driven through a status lifecycle.
Linked to Organizations, Team members, Business units - Controls
Controls that mitigate a risk and are executed by a named owner.
Linked to Risks, Team members - Record attachments
Evidence files attached to an assessment with a visibility scope.
Linked to Assessments, Team members - Findings
Findings raised from failed or inconclusive control testing.
Linked to Assessments, Controls
- Campus control reviews
Campus control reviews covering policy references and open exceptions.
Linked to Assessments, Organizations - Assessments
Scoped assessment engagements driven through a status lifecycle.
Linked to Organizations, Team members, Business units - Organizations
Legal and operating organizations governed by this workspace.
- Review decisions
Independent reviewer decisions recorded against an assessment revision.
Linked to Assessments, Team members - Findings
Findings raised from failed or inconclusive control testing.
Linked to Assessments, Controls
- Findings
Findings raised from failed or inconclusive control testing.
Linked to Assessments, Controls - Corrective actions
Remediation actions assigned to a finding owner with due dates and evidence.
Linked to Findings, Team members - Retests
Independent retests that decide whether a finding may be closed.
Linked to Findings, Team members - Assessment tests
Individual control tests executed under an assessment.
Linked to Assessments, Controls - Controls
Controls that mitigate a risk and are executed by a named owner.
Linked to Risks, Team members - Assessments
Scoped assessment engagements driven through a status lifecycle.
Linked to Organizations, Team members, Business units
- Review decisions
Independent reviewer decisions recorded against an assessment revision.
Linked to Assessments, Team members - Retests
Independent retests that decide whether a finding may be closed.
Linked to Findings, Team members - Operation receipts
Idempotent execution receipts for guarded operations on assessments.
Linked to Assessments - Assessments
Scoped assessment engagements driven through a status lifecycle.
Linked to Organizations, Team members, Business units - Findings
Findings raised from failed or inconclusive control testing.
Linked to Assessments, Controls - Corrective actions
Remediation actions assigned to a finding owner with due dates and evidence.
Linked to Findings, Team members - Record attachments
Evidence files attached to an assessment with a visibility scope.
Linked to Assessments, Team members
Keys and references
The assessment’s record number identifies the engagement. Assessment tests.Parent, campus control reviews.Parent, record attachments.Parent, operation receipts.Parent and review decisions.Parent point to it. A finding points to its assessment and control; an action and a retest point to the finding. Team member references identify owners, uploaders and reviewers. Codes identify organizations, units and controls, while revision fields preserve the version used in a decision.
Migration order
- Create Organizations, Users and team members, then business units with their organization links.
- Load Risks for each unit and Controls for each risk and owner.
- Create Assessments with scope and period, then linked assessment tests and campus control reviews.
- Add record attachments, Findings and corrective actions as the first cycle produces them.
- Add Retests, review decisions and operation receipts with their parent and reviewer links intact.
Set up GRC for Education and Universities your way.
Start free, then use Proto to change fields, steps and approvals before your team goes live.