Set risk appetite people can actually use
Connect the organisation’s objectives to clear decision limits, escalation routes and evidence of what the board will accept.
Read guideThe reference library
Practical GRC guidance
Follow a responsibility from its source to the controls, evidence and decisions behind it.
Browse the complete GRC resource map.
Record a board decision that can be explained
Build a useful record of authority, evidence, challenge, conflicts and follow-through without reducing directors’ duties to a tick-box exercise.
Read guideFrom a control list to board assurance
Explain what each important control does, how it was tested and what the evidence allows the board to conclude.
Read guideGive every policy an owner and a review path
Turn a folder of policies into a manageable register of decisions, responsibilities, training and evidence.
Read guideFraud prevention: scope before templates
Understand the failure-to-prevent-fraud starting point and connect prevention to incentives, associated persons, practical controls and oversight.
Read guideBuild a risk register that supports decisions
Connect each risk to an objective, accountable owner, control evidence and a decision that someone can act on.
Read guideTest controls and keep an evidence trail
Distinguish a policy being written from a control being designed well and operating consistently.
Read guideReview suppliers across the whole relationship
Prioritise critical dependencies, ask for relevant evidence, and plan monitoring and exit before a supplier fails.
Read guidePractise disruption before it becomes a crisis
Use a focused scenario to test decisions, dependencies and recovery assumptions, then track the lessons to completion.
Read guideBring cyber risk into the board's decisions
Translate technical reporting into business exposure, accountable decisions and evidence of resilience.
Read guideBuild an obligations register that changes the work
Connect each applicable requirement to a responsible owner, a practical control and evidence that it operates.
Read guideUK GDPR accountability and DPIA triage
Connect data protection decisions to evidence, and identify when a project needs a data protection impact assessment.
Read guideAML scope and assurance: start with the activity
Identify the relevant AML regime, then connect the business risk assessment to controls, case evidence and review.
Read guideIncident and personal data breach escalation
Prepare a clear response route, assess harm and record the reasons for reporting or not reporting a personal data breach.
Read guideTraining and monitoring that test understanding
Turn policy awareness into role-specific decisions, then use monitoring results to improve the programme.
Read guideNo matching resources. Try a broader term or select All.