DE
FRWhen the regulator asks,
how fast can you answer?
Assign, implement and evidence regulatory obligations.
From the regulation to the evidence, in one system.
Trusted by leading organisations
From the known regulation
to the evidenced obligation
Knowing the regulation is the craft. What sets a function apart is whether every single obligation has an owner, a control and current evidence.
The obligations register lives in Excel
Regulations on a drive, obligations in a spreadsheet, evidence in the inbox. When a new rule arrives, the search starts over.
- Regulations and obligations spread across sheets and folders
- Nowhere does it say who owns an obligation
- Policies, training and whistleblowing run in separate places
- A supervisory request triggers days of manual work
One obligations register, connected end to end
Regulation, chapter, obligation, owner, control and evidence sit in one model. The state of compliance can be queried at any time.
- Regulations broken down to the single obligation
- Every obligation with owner, due date and organizational unit
- Controls, policies and training attached to the obligation
- Whistleblowing, incidents and cases in the same network
Compliance the way
it works day to day
Five views from the compliance module of the SwissGRC® platform, along the chain of regulation, assessment, risk, incident and report.
Every regulation down to the single obligation
Regulations are held by regulatory authority, topic and jurisdiction and broken down into chapters, subchapters and individual obligations. Every obligation carries an owner.
- Regulatory authority, topic and jurisdiction per regulation
- Breakdown into chapters, subchapters and obligations
- Regulatory content entered manually or via a content provider
- Ownership, due date and organizational unit on the obligation
Maturity per requirement, with evidence
Standards and regulations are assessed clause by clause, with maturity, findings and attached evidence. Progress stays visible at all times.
- Assessment along the clause structure of the standard
- Maturity and compliance state per requirement
- Findings captured directly on the clause
- Evidence attached at the point of assessment
Compliance risk rated and monitored
Compliance risks are rated by category, organizational unit and regulatory topic and linked to controls and actions. The state of remediation reads at a glance.
- Rating by category, unit and regulatory topic
- Risk register linked to controls and actions
- Actions by status, with escalation and due dates
- Compliance risk map for management and committee
From the tip to the closed case file
Breaches, misconduct and suspected fraud are handled as cases, with category, severity, ownership and time of incident. Traceable from detection to resolution.
- Category, subcategory and severity per case
- Status from detection through to resolution
- Ownership and affected organizational unit
- Link to risk, control and action
A reporting channel that earns trust
A confidential channel guides whistleblowers through the report in three steps, fully anonymous if they choose. The reply channel runs on an access code, without identity.
- Guided report in three steps, with category selection
- Anonymous access code for follow-up questions and status
- No connection data is stored
- Reports land directly in case management
What a compliance system
has to be able to prove
ISO 37301 made compliance management certifiable for the first time. Clause 4.5 requires the identification of compliance obligations, clause 4.6 their risk assessment and clause 8.3 a process for raising concerns. The platform covers exactly these three points.
and data sit in the same model.
What you get out of it
Not more compliance, but provable compliance. With less manual work.
One obligations register
Every regulation broken down to the single obligation, with authority, topic and jurisdiction. One source instead of five spreadsheets.
Compliance evidenced
For every obligation the control, the evidence and the date. Still readable long after ownership has changed hands.
Regulatory change
New rules are captured, assessed and assigned instead of discovered by accident. The effort stays plannable.
Ownership in the open
Owner, due date and organizational unit on every obligation. Nobody has to ask who is responsible.
Spot concerns early
Whistleblowing reports, incidents and conflicts of interest come together in the same case file. Patterns surface before they get expensive.
Across GRC
Compliance shares the organizational model, controls and actions with risk management, internal control and internal audit. Nothing is maintained twice.
See our compliance
solution in action
In a personal demo we walk you through the obligations register, the assessment, case management and the reporting channel. You see how a single obligation runs from the regulation all the way to the evidence.
