{"id":70703,"date":"2026-09-23T15:53:56","date_gmt":"2026-09-23T13:53:56","guid":{"rendered":"https:\/\/swissgrc.com\/ar\/grc-software-vantage-point-continuous-monitoring\/"},"modified":"2026-09-23T16:30:03","modified_gmt":"2026-09-23T14:30:03","slug":"grc-software-vantage-point-continuous-monitoring","status":"publish","type":"post","link":"https:\/\/swissgrc.com\/ar\/grc-software-vantage-point-continuous-monitoring\/","title":{"rendered":"When GRC Software Becomes a Vantage Point"},"content":{"rendered":"<div id=\"sgce-a\" class=\"sgce-article\">\n<p class=\"rc-lede\">Gartner places the GRC software market in a new growth phase for 2025, driven by AI and shifting cyber risks. Behind this market movement lies a quieter but more consequential shift: away from spot-check control testing, toward continuous observation of risks and controls. This shift is not primarily a technical issue but a governance one. Those who monitor continuously must also be able to continuously assign responsibility, report, and decide.<\/p>\n<div class=\"rc-tldr\">\n<div class=\"rc-tldr-label\">In short<\/div>\n<p>The shift from periodic control testing to continuous monitoring primarily tightens governance obligations: institutions must maintain complete risk inventories, clarify responsibilities across the three lines, and make reporting lines to executive management and the board more concrete. Supervisory authorities such as FINMA do not prescribe a specific monitoring technology, but require traceable, up to date evidence, regardless of how often controls are tested.<\/p>\n<\/div>\n<nav class=\"rc-toc\" aria-label=\"Contents\">\n<div class=\"rc-toc-label\">Contents<\/div>\n<ol>\n<li><a href=\"#a1-what-do-supervisory-texts-actually-requi\">What do supervisory texts actually require?<\/a><\/li>\n<li><a href=\"#a2-does-periodic-testing-remain-in-place-re\">Does periodic testing remain in place regardless?<\/a><\/li>\n<li><a href=\"#a3-what-does-the-three-lines-model-change-a\">What does the Three Lines Model change about collaboration?<\/a><\/li>\n<li><a href=\"#a4-how-does-this-affect-the-independence-of\">How does this affect the independence of the second line?<\/a><\/li>\n<li><a href=\"#a5-what-does-this-mean-for-reporting-lines-\">What does this mean for reporting lines to executive management and the board?<\/a><\/li>\n<\/ol>\n<\/nav>\n<div class=\"rc-figures\">\n<div class=\"rc-figure-cell\">\n<div class=\"rc-figure-value\" data-to=\"111\">111<span class=\"unit\">inspections<\/span><\/div>\n<div class=\"rc-figure-label\">FINMA on-site inspections at banks in 2024<\/div>\n<div class=\"rc-figure-src\">finews.ch, 8 April 2025<\/div>\n<\/div>\n<div class=\"rc-figure-cell\">\n<div class=\"rc-figure-value\" data-to=\"2\">2<span class=\"unit\">years<\/span><\/div>\n<div class=\"rc-figure-label\">Period between DORA entering into force and direct applicability<\/div>\n<div class=\"rc-figure-src\">KPMG \/ Orbiq<\/div>\n<\/div>\n<\/div>\n<h2 id=\"a1-what-do-supervisory-texts-actually-requi\">What do supervisory texts actually require?<\/h2>\n<p>Neither FINMA Circular 2023\/1 nor the EBA Guidelines on ICT risk prescribe continuous monitoring as a mandatory method, but both tighten the requirements for inventories and governance.<\/p>\n<p>The fully revised FINMA Circular 2023\/1 on operational risks and resilience was adopted on 13 December 2022 and entered into force on 1 January 2024, as Lexology reported on 19 January 2023. It is principles-based and technology-neutral, and requires a consistent, institution-wide inventory of operational risks.<\/p>\n<p>Within two years of the circular entering into force, institutions must, according to InfoGuard, ensure operational resilience and meet further requirements from the circular. This deadline concerns the substance of the evidence, not the frequency of the testing behind it.<\/p>\n<h2 id=\"a2-does-periodic-testing-remain-in-place-re\">Does periodic testing remain in place regardless?<\/h2>\n<p>Yes, point-in-time instruments such as on-site inspections remain a central supervisory tool, while certain obligations are monitored continuously in parallel.<\/p>\n<p>FINMA carried out 111 on-site inspections at banks, 55 at insurers and 20 in asset management in 2024, as finews.ch reported on 8 April 2025. At the same time, FINMA describes <a href=\"https:\/\/www.finma.ch\/en\/finma\/activities\/supervision\/\" target=\"_blank\" rel=\"noopener nofollow\">ongoing supervision of anti-money laundering rules<\/a> as a permanent task.<\/p>\n<p>For risk and compliance functions, this creates two parallel lines of evidence: continuously current data for the ongoing part of supervision, and audit-ready documentation for point-in-time inspections. Both lines need the same underlying data, but different preparation.<\/p>\n<div class=\"rc-callout\">\n<p>Two parallel lines of evidence emerge: ongoing data for permanent tasks, audit-ready documentation for on-site inspections.<\/p>\n<\/div>\n<h2 id=\"a3-what-does-the-three-lines-model-change-a\">What does the Three Lines Model change about collaboration?<\/h2>\n<p>The IIA renamed its model in 2020, placing greater emphasis on collaboration and accountability rather than pure defence, without specifying resource allocation between the lines in concrete terms.<\/p>\n<p>On 20 July 2020, the IIA published the major update to the Three Lines Model, deliberately dropping the term defense to signal that its purpose extends beyond pure protective measures, as Diligent noted on 19 December 2025.<\/p>\n<p>An analysis by the University of St. Gallen notes that the model introduced, for the first time, an explicit definition of the <a href=\"https:\/\/alexandria.unisg.ch\/bitstreams\/7b10168e-1994-485c-a94d-19ee8650feca\/download\" target=\"_blank\" rel=\"noopener nofollow\">concept of assurance<\/a>, which had previously been missing from the IIA standards. Neither the IIA nor the supervisory texts used here specify in detail how this affects job profiles or resources across the first, second and third lines.<\/p>\n<h2 id=\"a4-how-does-this-affect-the-independence-of\">How does this affect the independence of the second line?<\/h2>\n<p>The EBA Guidelines explicitly require separation of the control function from ICT operational processes, regardless of how closely monitoring is technically integrated.<\/p>\n<p>The EBA Guidelines on ICT and security risk management have applied since 30 June 2020 and, according to Proper Banking, are for the first time addressed directly to credit institutions and payment institutions. They require independence and objectivity of the control function through adequate organisational separation.<\/p>\n<p>A shared data basis for monitoring therefore does not automatically mean shared responsibility. Governance requirements for critical functions continue to demand separate responsibilities, even where the underlying data is the same.<\/p>\n<h2 id=\"a5-what-does-this-mean-for-reporting-lines-\">What does this mean for reporting lines to executive management and the board?<\/h2>\n<p>Under the eight principles of the FINMA circular, risk control reports to the board at least annually and to executive management at least twice a year, regardless of the testing method behind it.<\/p>\n<p>According to KPMG, the board must approve the bank&#8217;s critical functions and their disruption tolerances at least once a year, as Redguard summarised on 24 May 2024. At EU level, too, the framework is tightening: the DORA regulation entered into force on 16 January 2023 and applied directly to almost all financial entities from 17 January 2025, as KPMG and Orbiq note.<\/p>\n<p>These reporting deadlines do not change automatically as data points become more frequent. Those monitoring continuously should nonetheless check whether existing ICT risk controls deliver the right information for the next reporting cycle.<\/p>\n<p>One concrete first step: the risk or compliance function reconciles the existing control inventory with the reporting cycles for the board and executive management before the next regular reporting date, and documents any gaps in writing.<\/p>\n<div class=\"rc-bridge\">\n<div class=\"rc-bridge-mark\"><\/div>\n<div>\n<div class=\"rc-bridge-label\">Related<\/div>\n<h3>Control inventory and evidence in one place<\/h3>\n<p>The Internal Control System solution brings together the control inventory and test evidence. It supports both periodic testing cycles and continuously updated evidence.<\/p>\n<p><a href=\"https:\/\/swissgrc.com\/ar\/internal-control-software-ics\/\">Internal Controls <span class=\"rc-pfeil\" aria-hidden=\"true\"><\/span><\/a><\/div>\n<\/div>\n<aside class=\"rc-takeaways\">\n<div class=\"rc-takeaways-label\">For practice<\/div>\n<h2>Key points<\/h2>\n<ul>\n<li>FINMA Circular 2023\/1 does not mandate continuous monitoring, but requires more precise risk inventories and clear governance responsibilities.<\/li>\n<li>Periodic instruments such as on-site inspections remain in place under FINMA&#8217;s 2024 practice, even as other obligations are monitored continuously.<\/li>\n<li>The 2020 Three Lines Model shifts the focus to collaboration and accountability, without concretely assigning roles or resources.<\/li>\n<li>The EBA Guidelines continue to require organisational separation of the control function from ICT operational processes, regardless of the monitoring technology used.<\/li>\n<li>A first step is to reconcile the existing control inventory with the reporting cycles for the board and executive management.<\/li>\n<\/ul>\n<\/aside>\n<section class=\"rc-faq\">\n<div class=\"rc-faq-head\">\n<div class=\"rc-faq-label\">FAQ<\/div>\n<h2>Frequently asked questions<\/h2>\n<\/div>\n<div class=\"rc-faq-list\">\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">Does FINMA prescribe a specific monitoring technology?<\/span><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>No. Both FINMA Circular 2023\/1 and the EBA Guidelines on ICT risk are formulated in a technology-neutral way. They require traceable, up to date evidence on risks and controls, but do not prescribe a particular monitoring method or testing frequency. Institutions can combine periodic and continuous approaches as long as the governance requirements are met.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">How many on-site inspections did FINMA carry out in 2024?<\/span><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>According to finews.ch, FINMA carried out 111 on-site inspections at banks, 55 at insurers and 20 in asset management in 2024. These figures show that point-in-time supervisory instruments remain a central tool despite increasing continuous monitoring, and are not replaced by ongoing data collection.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">What did the Three Lines Model actually change in 2020?<\/span><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>On 20 July 2020, the IIA renamed its model and dropped the term defense to place greater emphasis on collaboration and accountability. For the first time, the concept of assurance was explicitly defined. How this concretely affects job profiles or resources across the three lines remains unspecified.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">How often must risk control report to executive management under FINMA rules?<\/span><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>Under the eight principles of FINMA Circular 2023\/1, risk control reports to the board at least annually and to executive management at least twice a year. These deadlines apply regardless of whether the underlying data is collected periodically or continuously.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">What is a sensible first step when moving to continuous monitoring?<\/span><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>The risk or compliance function should reconcile the existing control inventory with the reporting cycles for the board and executive management before the next regular reporting date. Any gaps identified should be documented in writing so that the data basis for both lines of evidence stays consistent.<\/p>\n<\/div>\n<\/details>\n<\/div>\n<\/section>\n<section class=\"rc-sources\">\n<div class=\"rc-sources-label\">Sources<\/div>\n<ol>\n<li><a href=\"https:\/\/www.finma.ch\/en\/finma\/activities\/supervision\/\" target=\"_blank\" rel=\"noopener nofollow\">Effective supervision creates a stable financial system<\/a><span class=\"rc-source-pub\">FINMA<\/span><\/li>\n<li><a href=\"https:\/\/alexandria.unisg.ch\/bitstreams\/7b10168e-1994-485c-a94d-19ee8650feca\/download\" target=\"_blank\" rel=\"noopener nofollow\">The Three Lines Model and the Concept of Assurance<\/a><span class=\"rc-source-pub\">University of St. Gallen, Expert Focus<\/span><\/li>\n<\/ol>\n<\/section>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>The shift from periodic control testing to continuous monitoring primarily tightens governance obligations: institutions must maintain complete risk inventories, clarify responsibilities across the three lines, and make reporting lines to executive management and the board more concrete. Supervisory authorities such as FINMA do not prescribe a specific monitoring technology, but require traceable, up to date evidence, regardless of how often controls are tested.<\/p>\n","protected":false},"author":5,"featured_media":70709,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"_eb_attr":"","_swissgrc_real_author":"Yahya Mohamed Mao","real_author_title":"Chief Marketing Officer","real_author_bio":"Views GRC through the lens of market, brand and growth. Writes about making complex topics accessible, building trust and what it takes to position and scale a specialized software platform internationally.","real_author_photo":70555,"footnotes":"","_links_to":"","_links_to_target":""},"categories":[105],"tags":[214,166,212,213],"class_list":["post-70703","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-regulation-supervision","tag-grc-software-governance-obligations","tag-finma-circular-2023-1","tag-three-lines-model","tag-eba-guidelines-on-ict-risk"],"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO Pro 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"Continuous monitoring tightens governance obligations in GRC: what FINMA and EBA require for risk inventories and reporting lines.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"superadmin\"\/>\n\t<meta name=\"google-site-verification\" content=\"google-site-verification=BAztS2wKP0jEfbvHt4_mrvvD17WwzZg1w1A6R9uoQRU\" \/>\n\t<link rel=\"canonical\" href=\"https:\/\/swissgrc.com\/ar\/grc-software-vantage-point-continuous-monitoring\/\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO Pro (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"ar_AR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Swiss GRC AR | Governance, Risk &amp; Compliance (GRC)\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"Continuous Monitoring: Governance Obligations in GRC\" \/>\n\t\t<meta property=\"og:description\" content=\"Continuous monitoring tightens governance obligations in GRC: what FINMA and EBA require for risk inventories and reporting lines.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/swissgrc.com\/ar\/grc-software-vantage-point-continuous-monitoring\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/09\/Blog_Image_Vantage_Point_EN.png\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/09\/Blog_Image_Vantage_Point_EN.png\" \/>\n\t\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-09-23T13:53:56+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-09-23T14:30:03+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@SwissGRC\" \/>\n\t\t<meta name=\"twitter:title\" content=\"Continuous Monitoring: Governance Obligations in GRC\" \/>\n\t\t<meta name=\"twitter:description\" content=\"Continuous monitoring tightens governance obligations in GRC: what FINMA and EBA require for risk inventories and reporting lines.\" \/>\n\t\t<meta name=\"twitter:creator\" content=\"@SwissGRC\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/09\/Blog_Image_Vantage_Point_EN.png\" \/>\n\t\t<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t\t<meta name=\"twitter:data1\" content=\"superadmin\" \/>\n\t\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/grc-software-vantage-point-continuous-monitoring\\\/#blogposting\",\"name\":\"Continuous Monitoring: Governance Obligations in GRC\",\"headline\":\"When GRC Software Becomes a Vantage Point\",\"author\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/author\\\/superadmin\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/wp-content\\\/uploads\\\/sites\\\/5\\\/2026\\\/09\\\/Blog_Image_Vantage_Point_EN.png\",\"width\":1200,\"height\":630,\"caption\":\"GRC software as a central vantage point for risks, controls and compliance\"},\"datePublished\":\"2026-09-23T15:53:56+02:00\",\"dateModified\":\"2026-09-23T16:30:03+02:00\",\"inLanguage\":\"ar\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/grc-software-vantage-point-continuous-monitoring\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/grc-software-vantage-point-continuous-monitoring\\\/#webpage\"},\"articleSection\":\"Regulation &amp; Supervision, GRC software governance obligations, FINMA Circular 2023\\\/1, Three Lines Model, EBA Guidelines on ICT risk\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/grc-software-vantage-point-continuous-monitoring\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/category\\\/regulation-supervision\\\/#listItem\",\"name\":\"Regulation &amp; Supervision\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/category\\\/regulation-supervision\\\/#listItem\",\"position\":2,\"name\":\"Regulation &amp; Supervision\",\"item\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/category\\\/regulation-supervision\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/grc-software-vantage-point-continuous-monitoring\\\/#listItem\",\"name\":\"When GRC Software Becomes a Vantage Point\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/grc-software-vantage-point-continuous-monitoring\\\/#listItem\",\"position\":3,\"name\":\"When GRC Software Becomes a Vantage Point\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/category\\\/regulation-supervision\\\/#listItem\",\"name\":\"Regulation &amp; Supervision\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#organization\",\"name\":\"Swiss GRC AG\",\"description\":\"Swiss GRC delivers Software Solutions for GRC, CLM &amp; BPM, helping businesses worldwide manage risks, ensure compliance, and drive success.\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/\",\"telephone\":\"+41412207500\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2023\\\/06\\\/Logo_V1_Original_mit_Claim.png\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/grc-software-vantage-point-continuous-monitoring\\\/#organizationLogo\"},\"image\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/grc-software-vantage-point-continuous-monitoring\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/www.twitter.com\\\/SwissGRC\",\"https:\\\/\\\/www.instagram.com\\\/swissgrc\\\/\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UCy4QuXYekCQrA4n5oEwJSJg\",\"https:\\\/\\\/ch.linkedin.com\\\/company\\\/swissgrc\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/author\\\/superadmin\\\/#author\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/author\\\/superadmin\\\/\",\"name\":\"superadmin\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/grc-software-vantage-point-continuous-monitoring\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/75672523c5e2db95feb2c8c3d6cf134b011e26e6f14621731855ff4a8c3327d7?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"superadmin\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/grc-software-vantage-point-continuous-monitoring\\\/#webpage\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/grc-software-vantage-point-continuous-monitoring\\\/\",\"name\":\"Continuous Monitoring: Governance Obligations in GRC\",\"description\":\"Continuous monitoring tightens governance obligations in GRC: what FINMA and EBA require for risk inventories and reporting lines.\",\"inLanguage\":\"ar\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/grc-software-vantage-point-continuous-monitoring\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/author\\\/superadmin\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/author\\\/superadmin\\\/#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/wp-content\\\/uploads\\\/sites\\\/5\\\/2026\\\/09\\\/Blog_Image_Vantage_Point_EN.png\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/grc-software-vantage-point-continuous-monitoring\\\/#mainImage\",\"width\":1200,\"height\":630,\"caption\":\"GRC software as a central vantage point for risks, controls and compliance\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/grc-software-vantage-point-continuous-monitoring\\\/#mainImage\"},\"datePublished\":\"2026-09-23T15:53:56+02:00\",\"dateModified\":\"2026-09-23T16:30:03+02:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#website\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/\",\"name\":\"Swiss GRC - Software Solutions for GRC, CLM &amp; BPM\",\"description\":\"Governance, Risk & Compliance (GRC)\",\"inLanguage\":\"ar\",\"publisher\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO Pro -->\r\n\t\t<title>Continuous Monitoring: Governance Obligations in GRC<\/title>\n\n","aioseo_head_json":{"title":"Continuous Monitoring: Governance Obligations in GRC","description":"Continuous monitoring tightens governance obligations in GRC: what FINMA and EBA require for risk inventories and reporting lines.","canonical_url":"https:\/\/swissgrc.com\/ar\/grc-software-vantage-point-continuous-monitoring\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"google-site-verification":"google-site-verification=BAztS2wKP0jEfbvHt4_mrvvD17WwzZg1w1A6R9uoQRU","miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/swissgrc.com\/ar\/grc-software-vantage-point-continuous-monitoring\/#blogposting","name":"Continuous Monitoring: Governance Obligations in GRC","headline":"When GRC Software Becomes a Vantage Point","author":{"@id":"https:\/\/swissgrc.com\/ar\/author\/superadmin\/#author"},"publisher":{"@id":"https:\/\/swissgrc.com\/ar\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/09\/Blog_Image_Vantage_Point_EN.png","width":1200,"height":630,"caption":"GRC software as a central vantage point for risks, controls and compliance"},"datePublished":"2026-09-23T15:53:56+02:00","dateModified":"2026-09-23T16:30:03+02:00","inLanguage":"ar","mainEntityOfPage":{"@id":"https:\/\/swissgrc.com\/ar\/grc-software-vantage-point-continuous-monitoring\/#webpage"},"isPartOf":{"@id":"https:\/\/swissgrc.com\/ar\/grc-software-vantage-point-continuous-monitoring\/#webpage"},"articleSection":"Regulation &amp; Supervision, GRC software governance obligations, FINMA Circular 2023\/1, Three Lines Model, EBA Guidelines on ICT risk"},{"@type":"BreadcrumbList","@id":"https:\/\/swissgrc.com\/ar\/grc-software-vantage-point-continuous-monitoring\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/#listItem","position":1,"name":"Home","item":"https:\/\/swissgrc.com\/ar\/","nextItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/category\/regulation-supervision\/#listItem","name":"Regulation &amp; Supervision"}},{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/category\/regulation-supervision\/#listItem","position":2,"name":"Regulation &amp; Supervision","item":"https:\/\/swissgrc.com\/ar\/category\/regulation-supervision\/","nextItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/grc-software-vantage-point-continuous-monitoring\/#listItem","name":"When GRC Software Becomes a Vantage Point"},"previousItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/grc-software-vantage-point-continuous-monitoring\/#listItem","position":3,"name":"When GRC Software Becomes a Vantage Point","previousItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/category\/regulation-supervision\/#listItem","name":"Regulation &amp; Supervision"}}]},{"@type":"Organization","@id":"https:\/\/swissgrc.com\/ar\/#organization","name":"Swiss GRC AG","description":"Swiss GRC delivers Software Solutions for GRC, CLM &amp; BPM, helping businesses worldwide manage risks, ensure compliance, and drive success.","url":"https:\/\/swissgrc.com\/ar\/","telephone":"+41412207500","logo":{"@type":"ImageObject","url":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2023\/06\/Logo_V1_Original_mit_Claim.png","@id":"https:\/\/swissgrc.com\/ar\/grc-software-vantage-point-continuous-monitoring\/#organizationLogo"},"image":{"@id":"https:\/\/swissgrc.com\/ar\/grc-software-vantage-point-continuous-monitoring\/#organizationLogo"},"sameAs":["https:\/\/www.twitter.com\/SwissGRC","https:\/\/www.instagram.com\/swissgrc\/","https:\/\/www.youtube.com\/channel\/UCy4QuXYekCQrA4n5oEwJSJg","https:\/\/ch.linkedin.com\/company\/swissgrc"]},{"@type":"Person","@id":"https:\/\/swissgrc.com\/ar\/author\/superadmin\/#author","url":"https:\/\/swissgrc.com\/ar\/author\/superadmin\/","name":"superadmin","image":{"@type":"ImageObject","@id":"https:\/\/swissgrc.com\/ar\/grc-software-vantage-point-continuous-monitoring\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/75672523c5e2db95feb2c8c3d6cf134b011e26e6f14621731855ff4a8c3327d7?s=96&d=mm&r=g","width":96,"height":96,"caption":"superadmin"}},{"@type":"WebPage","@id":"https:\/\/swissgrc.com\/ar\/grc-software-vantage-point-continuous-monitoring\/#webpage","url":"https:\/\/swissgrc.com\/ar\/grc-software-vantage-point-continuous-monitoring\/","name":"Continuous Monitoring: Governance Obligations in GRC","description":"Continuous monitoring tightens governance obligations in GRC: what FINMA and EBA require for risk inventories and reporting lines.","inLanguage":"ar","isPartOf":{"@id":"https:\/\/swissgrc.com\/ar\/#website"},"breadcrumb":{"@id":"https:\/\/swissgrc.com\/ar\/grc-software-vantage-point-continuous-monitoring\/#breadcrumblist"},"author":{"@id":"https:\/\/swissgrc.com\/ar\/author\/superadmin\/#author"},"creator":{"@id":"https:\/\/swissgrc.com\/ar\/author\/superadmin\/#author"},"image":{"@type":"ImageObject","url":"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/09\/Blog_Image_Vantage_Point_EN.png","@id":"https:\/\/swissgrc.com\/ar\/grc-software-vantage-point-continuous-monitoring\/#mainImage","width":1200,"height":630,"caption":"GRC software as a central vantage point for risks, controls and compliance"},"primaryImageOfPage":{"@id":"https:\/\/swissgrc.com\/ar\/grc-software-vantage-point-continuous-monitoring\/#mainImage"},"datePublished":"2026-09-23T15:53:56+02:00","dateModified":"2026-09-23T16:30:03+02:00"},{"@type":"WebSite","@id":"https:\/\/swissgrc.com\/ar\/#website","url":"https:\/\/swissgrc.com\/ar\/","name":"Swiss GRC - Software Solutions for GRC, CLM &amp; BPM","description":"Governance, Risk & Compliance (GRC)","inLanguage":"ar","publisher":{"@id":"https:\/\/swissgrc.com\/ar\/#organization"}}]},"og:locale":"ar_AR","og:site_name":"Swiss GRC AR | Governance, Risk &amp; Compliance (GRC)","og:type":"article","og:title":"Continuous Monitoring: Governance Obligations in GRC","og:description":"Continuous monitoring tightens governance obligations in GRC: what FINMA and EBA require for risk inventories and reporting lines.","og:url":"https:\/\/swissgrc.com\/ar\/grc-software-vantage-point-continuous-monitoring\/","og:image":"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/09\/Blog_Image_Vantage_Point_EN.png","og:image:secure_url":"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/09\/Blog_Image_Vantage_Point_EN.png","og:image:width":1200,"og:image:height":630,"article:published_time":"2026-09-23T13:53:56+00:00","article:modified_time":"2026-09-23T14:30:03+00:00","twitter:card":"summary_large_image","twitter:site":"@SwissGRC","twitter:title":"Continuous Monitoring: Governance Obligations in GRC","twitter:description":"Continuous monitoring tightens governance obligations in GRC: what FINMA and EBA require for risk inventories and reporting lines.","twitter:creator":"@SwissGRC","twitter:image":"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/09\/Blog_Image_Vantage_Point_EN.png","twitter:label1":"Written by","twitter:data1":"superadmin","twitter:label2":"Est. reading time","twitter:data2":"6 minutes"},"aioseo_meta_data":{"post_id":"70703","title":"Continuous Monitoring: Governance Obligations in GRC","description":"Continuous monitoring tightens governance obligations in GRC: what FINMA and EBA require for risk inventories and reporting lines.","keywords":null,"keyphrases":{"focus":{"keyphrase":"continuous monitoring","score":79},"additional":[{"keyphrase":"Three Lines Model","score":78},{"keyphrase":"FINMA Circular 2023\/1","score":78},{"keyphrase":"EBA Guidelines on ICT risk","score":69},{"keyphrase":"GRC software governance obligations","score":69}]},"primary_term":null,"canonical_url":null,"og_title":"Continuous Monitoring: Governance Obligations in GRC","og_description":"Continuous monitoring tightens governance obligations in GRC: what FINMA and EBA require for risk inventories and reporting lines.","og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":"Continuous Monitoring: Governance Obligations in GRC","twitter_description":"Continuous monitoring tightens governance obligations in GRC: what FINMA and EBA require for risk inventories and reporting lines.","schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"BlogPosting","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"seo_analyzer_scan_date":"2026-09-23 14:30:47","breadcrumb_settings":null,"limit_modified_date":false,"open_ai":null,"ai":{"faqs":[],"keyPoints":[],"schemas":[],"titles":[],"descriptions":[],"socialPosts":{"email":{"subject":"","preview":"","content":""},"linkedin":[],"twitter":[],"facebook":[],"instagram":[]}},"created":"2026-09-23 15:53:56","updated":"2026-09-23 14:40:51","focus_keyword":"continuous monitoring","additional_keywords":[{"word":"Three Lines Model","score":78,"items":{"introductionKeyword":{"score":3},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":9},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":3}}},{"word":"FINMA Circular 2023\/1","score":78,"items":{"introductionKeyword":{"score":3},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":9},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":3}}},{"word":"EBA Guidelines on ICT risk","score":69,"items":{"introductionKeyword":{"score":3},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":4},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":3}}},{"word":"GRC software governance obligations","score":69,"items":{"introductionKeyword":{"score":3},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":4},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":3}}}],"truseo_locale":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/swissgrc.com\/ar\/\" title=\"Home\">Home<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/swissgrc.com\/ar\/category\/regulation-supervision\/\" title=\"Regulation &amp; Supervision\">Regulation &amp; Supervision<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\tWhen GRC Software Becomes a Vantage Point\n<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/swissgrc.com\/ar\/"},{"label":"Regulation &amp; Supervision","link":"https:\/\/swissgrc.com\/ar\/category\/regulation-supervision\/"},{"label":"When GRC Software Becomes a Vantage Point","link":"https:\/\/swissgrc.com\/ar\/grc-software-vantage-point-continuous-monitoring\/"}],"_links":{"self":[{"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/posts\/70703","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/comments?post=70703"}],"version-history":[{"count":1,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/posts\/70703\/revisions"}],"predecessor-version":[{"id":70708,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/posts\/70703\/revisions\/70708"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/media\/70709"}],"wp:attachment":[{"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/media?parent=70703"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/categories?post=70703"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/tags?post=70703"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}