Questions, answered

Click Get started, then use Proto to configure GRC for Education and Universities for your business. Start with one organization, one campus unit, one active control and a bounded assessment period.

The Assessment Owner scopes the engagement and coordinates its tests. A named team member is recorded on the assessment.

A risk belongs to a business unit. A control belongs to that risk, and an assessment test points to the control and its parent assessment.

The test records an evidence reference. The assessment can also hold an attachment with internal or shared visibility.

The Assessment Owner registers a specific finding from a failed or inconclusive test, with severity, description and links to the assessment and control.

The action owner supplies the corrective response and evidence. An independent reviewer performs the retest; only a pass closes the finding.

The Campus Reviewer records the campus, policy reference and open exceptions. The Independent Reviewer records a reasoned decision against the parent assessment revision, identifying the campus context in the reason.

The Assessment Owner reconciles tests, findings and decisions before closing the assessment. A review decision remains a separate judgement.

Operations Overview has a filterable exception queue. Operation receipts retain the operation key, state and failure reason for follow-up.

Repeat the agreed risk scale, control naming, evidence and reviewer rules with each additional unit. Review one full case before broadening the operating cycle.