The GRC Toolbox makes a significant contribution to increasing transparency and traceability across our risk and security processes. For a university hospital, this is a decisive factor in ensuring high levels of patient safety, organizational resilience, and reliable governance. The close collaboration with Swiss GRC has enabled us to further develop our existing structures and establish a solid foundation for future requirements.
Zurich University Hospital (USZ) is one of Switzerland’s leading medical centers, offering a comprehensive range of highly specialized diagnostics, treatments, and research. With more than 10,000 employees, USZ fulfills a central role in patient care, medical education, and scientific advancement. The combination of clinical excellence, research expertise, and innovative care models makes USZ a key institution within the Swiss healthcare system.
Zurich University Hospital (USZ) is one of Switzerland’s leading healthcare institutions and faces complex daily requirements related to security, quality, and resilience. Through the Association of Zurich Hospitals, USZ became aware of Swiss GRC at an early stage. The trigger for the project was a strategic decision to establish an integrated and standardized risk and business continuity management approach that would optimize and consolidate existing processes.
This need was driven by both internal objectives and external requirements. Internally, the focus was on strengthening the hospital’s risk and security culture, increasing transparency, and creating a consistent data basis across all departments. Externally, rising regulatory expectations and the growing complexity of the healthcare sector acted as catalysts for expanding and scaling the existing GRC framework.
The project objectives were clearly defined:
The implementation of the GRC Toolbox was carried out in close coordination between the USZ project team and the consultants from Swiss GRC. From the outset, the collaboration was characterized by open communication, short decision-making paths, and a strong focus on execution. Requirements were jointly specified, processes were systematically mapped, and both functional and technical questions were resolved efficiently.
Challenges that arose during implementation were addressed and resolved promptly thanks to the constructive partnership. Particularly valuable for USZ was the fast response time of Swiss GRC, which significantly accelerated the project and enabled the continuous evolution of the solution.
The modular architecture of the GRC Toolbox allowed for a phased rollout of key functional areas. Today, USZ already uses the ISMS, Risk Management, BCM, and Audit modules. The Data Protection and Internal Control System (ICS) modules are nearing final implementation. In addition, the expansion to include a Third Party Risk Management (TPRM) module is planned for the coming year, enabling structured and transparent management of external dependencies.
| Challenges | Solution approach |
| Heterogeneous, partly manual and Excel-based risk and security processes | Introduction of a central digital platform with standardized and traceable workflows |
| Need for greater transparency and a consistent data foundation | Establishment of clearly defined structures, roles, and assessment methodologies within the toolbox |
| Strengthening the security and risk culture in hospital operations | Systematic mapping of processes within ISMS, Risk Management, and BCM to promote a unified approach |
| Interdisciplinary collaboration across multiple departments | Close coordination, an agile implementation approach, and continuous support from Swiss GRC |
The implementation of the GRC Toolbox enabled USZ to structurally strengthen and modernize core elements of its risk and security management. Previously decentralized and partially manual processes were replaced by a unified digital platform that now provides a consistent data foundation across all relevant areas. This has resulted in significantly improved transparency, efficiency, and traceability in day-to-day operations.
A key benefit is that all data can now be centrally captured, analyzed, and evaluated. The harmonization of processes also facilitates coordination between departments and enables structured, audit-ready documentation. As a result, USZ now operates a GRC framework that not only supports compliance with internal standards but also provides a strong foundation for meeting regulatory requirements. The clearly defined digital standards within the toolbox create clarity for all users and foster a shared understanding of risk and security processes.
The decision in favor of Swiss GRC was driven by several factors. Particularly decisive were the positive references USZ obtained from other organizations, as well as the additional trust created by the option to procure the solution via the Association of Zurich Hospitals. Swiss GRC also impressed with a modular solution that can be flexibly adapted to the needs of a complex hospital environment, combined with strong domain expertise in governance, risk, and compliance.
The implementation demonstrated that the GRC Toolbox is not merely a technical tool, but a strategic foundation for building a resilient risk and security culture. The close collaboration and continuous enhancement of the solution further confirm the value of the chosen partnership.
IB Langenthal AG is a regional energy and infrastructure provider headquartered in Langenthal, Switzerland. The company reliably supplies the region with electricity,…
Regula Schneider
The BENEFIT Company is the Kingdom of Bahrain’s leading provider of electronic financial transactions and fintech services, operating at the core of…
Mansoor AlAlwan
Visana is one of the leading Swiss health and accident insurance providers. The company offers health, accident, supplementary, and property insurance for…
René NajerTalk to us about your governance, risk and compliance requirements. No form, just a conversation with someone who knows your industry.
DE
FR
IT
العربية