Questions, answered

Click Get started, then use Proto to configure GRC for Professional Services for your business. Begin with one organization, business unit, control and assessment period, then rehearse a test and review decision with named people.

Assessment Owner sets its organization, counterparty, period and scope and follows its progress through review and closure.

A control links to a business-unit risk, has a named owner and carries its effective date and state. Use active controls when planning current tests.

Assessment Tester records the test date, sample, exception count, result and evidence reference against the linked control test.

The tester can raise a finding tied to the assessment and control. Remediation Owner then records corrective work and supporting evidence.

An Independent Reviewer records a retest. Only a passing independent retest closes the finding and verifies the action; a failed or inconclusive result keeps it open.

A submitted client control review carries client scope, contract requirement and revision. Independent Reviewer records a reasoned decision against the source assessment revision; the review state changes without advancing the parent assessment.

The Assessment Owner reviews the parent assessment’s tests and findings before changing its state. A client review decision stays on the review record.

Assessment attachments have Internal or Shared visibility. Agree which files may be shared before preparing a client package.

Check organization membership, control ownership, sample results, rejected entries and the handoff between the corrective action owner and retest reviewer.