These cookies are required for the website to function properly. They ensure security, enable basic features like page navigation, and store user session data. You cannot disable these cookies.
- Professional Services GRC
- Data model
The tables behind Professional Services GRC
Professional Services GRC ships with 15 tables, grouped here by the feature that uses them. Every record your team works with lives in one of them, and you can add fields and tables in Proto.
- Tables
- 15
- Features
- 6
- Change it
- Add fields and tables in Proto
How the model is organised
Organization
Organizations, business units, team members and Users establish the operating context.
Risk and control
Risks belong to business units, and Controls link to risks and owners.
Assessment
Assessments parent assessment tests and client control reviews.
Exceptions
Findings link to assessments and controls; corrective actions and Retests link to findings.
Evidence and review
Record attachments, review decisions and operation receipts link to assessments.
Every table, by feature
- Organization5
- Risks and Controls6
- Assessments6
- Testing and Evidence5
- Findings and Remediation6
- Assurance Reviews6
- Organizations
Legal and operating organizations governed by this workspace.
- Business units
Operating units and counterparties that assessments and risks attach to.
Linked to Organizations - Team members
Named people who own, prepare and independently review work.
Linked to Organizations, Users - Users
Users
Linked to Users - Assessments
Scoped assessment engagements driven through a status lifecycle.
Linked to Organizations, Team members, Business units
- Risks
Risks held against a business unit on an explicit likelihood and impact scale.
Linked to Business units, Team members - Controls
Controls that mitigate a risk and are executed by a named owner.
Linked to Risks, Team members - Business units
Operating units and counterparties that assessments and risks attach to.
Linked to Organizations - Team members
Named people who own, prepare and independently review work.
Linked to Organizations, Users - Assessment tests
Individual control tests executed under an assessment.
Linked to Assessments, Controls - Findings
Findings raised from failed or inconclusive control testing.
Linked to Assessments, Controls
- Assessments
Scoped assessment engagements driven through a status lifecycle.
Linked to Organizations, Team members, Business units - Assessment tests
Individual control tests executed under an assessment.
Linked to Assessments, Controls - Organizations
Legal and operating organizations governed by this workspace.
- Business units
Operating units and counterparties that assessments and risks attach to.
Linked to Organizations - Team members
Named people who own, prepare and independently review work.
Linked to Organizations, Users - Operation receipts
Idempotent execution receipts for guarded operations on assessments.
Linked to Assessments
- Assessment tests
Individual control tests executed under an assessment.
Linked to Assessments, Controls - Record attachments
Evidence files attached to an assessment with a visibility scope.
Linked to Assessments, Team members - Assessments
Scoped assessment engagements driven through a status lifecycle.
Linked to Organizations, Team members, Business units - Controls
Controls that mitigate a risk and are executed by a named owner.
Linked to Risks, Team members - Operation receipts
Idempotent execution receipts for guarded operations on assessments.
Linked to Assessments
- Findings
Findings raised from failed or inconclusive control testing.
Linked to Assessments, Controls - Corrective actions
Remediation actions assigned to a finding owner with due dates and evidence.
Linked to Findings, Team members - Retests
Independent retests that decide whether a finding may be closed.
Linked to Findings, Team members - Assessment tests
Individual control tests executed under an assessment.
Linked to Assessments, Controls - Controls
Controls that mitigate a risk and are executed by a named owner.
Linked to Risks, Team members - Assessments
Scoped assessment engagements driven through a status lifecycle.
Linked to Organizations, Team members, Business units
- Client control reviews
Client-scoped control reviews with contract requirements and tested control counts.
Linked to Assessments, Organizations - Review decisions
Independent reviewer decisions recorded against an assessment revision.
Linked to Assessments, Team members - Assessments
Scoped assessment engagements driven through a status lifecycle.
Linked to Organizations, Team members, Business units - Assessment tests
Individual control tests executed under an assessment.
Linked to Assessments, Controls - Findings
Findings raised from failed or inconclusive control testing.
Linked to Assessments, Controls - Record attachments
Evidence files attached to an assessment with a visibility scope.
Linked to Assessments, Team members
Keys and references
An assessment identifies its organization, owner and counterparty. Each test identifies its assessment and control. A finding identifies the same assessment and control, making corrective work traceable to the review. Review decisions identify the source assessment revision. Evidence attachments carry an Internal or Shared visibility value.
Migration order
- Create Organizations and Users, then business units and team members.
- Create Risks and Controls with valid owners and business units.
- Create Assessments and linked assessment tests.
- Bring over Findings, corrective actions and Retests with their source links.
- Bring over client control reviews, record attachments, review decisions and operation receipts after their parent assessments exist.
Set up Professional Services GRC your way.
Start free, then use Proto to change fields, steps and approvals before your team goes live.