Audit, risk and compliance software that reports to the board.
GovernCore keeps the risk register, the control library, compliance obligations and internal audit on one record, so a control is tested once and every team reads the same result, and the committee reads the figures as they stood on the day.
Risk, on your own matrix
Risks are scored for likelihood and impact on the organisation's own matrix, as inherent, residual and target, and checked against the appetite the board set for each category. Treatment plans become actions; key risk indicators carry amber and red thresholds and a history of readings; incidents and losses are logged once and shared with compliance.
The assistant reads the minutes, incidents, open findings and red indicators of the last months against the register, and proposes risks it does not hold yet and risks that need another look. A proposal becomes a draft risk only when the risk officer adds it.
Controls, tested once
One control library serves risk, compliance and audit. Each control can be linked to the risks it mitigates, the obligations it meets, and requirements in COSO or NamCode, with suggested links for a person to accept. A test plan is drafted from what the control does; the evidence is attached to the test and read against the plan before the result is recorded. A failed test raises a deficiency and an action for the control owner.
Compliance, adopted not typed
- Obligations adopted from a library of Acts and codes, or read out of the organisation's own permits and contracts.
- A compliance calendar in which a deadline on a weekend or public holiday moves to the business day before.
- Assessments that raise an action for every gap, and a breach log.
- Policies approved, published and attested to, checked against the obligations they serve, with questions readers answer before they sign.
- Statutory certificates watched against the tenders and renewals that need them, read from the scan when filed.
- A change in the law read against the register, with actions for the owners of what it touches.
- Anonymous speak-up, followed up with a case code only the reporter holds.
Internal audit, a file that stands up to review
The audit universe and a risk-based annual plan go to the committee for approval. Engagements move through planning, fieldwork and reporting, with information requests tracked rather than chased by email, and workpapers signed by a preparer and a different reviewer.
Findings are written in the standard form, condition, criteria, cause, effect and recommendation, and can be drafted from the auditor's notes. Management responses are checked for owners, dates and the cause before they are sent, and every agreed action is validated by an auditor before the finding closes.
Reported to the board
The committee view puts top risks, overdue actions, open findings by rating and compliance status on one page, with a first draft of the committee commentary written from the same figures. Frozen into the pack, it becomes a paper in the board portal.
Questions asked
1What is GRC software?
Governance, risk and compliance software keeps the registers an organisation is governed by: risks and their controls, the obligations it must meet, the policies people must follow, and the findings of its auditors. GovernCore keeps them on one record and takes them to the board.
2Does it include Namibian laws and codes?
Yes. A library of Namibian Acts and codes by sector can be adopted rather than typed, alongside the organisation's own licences, permits and agreements. NamCode positions, statutory certificates, BIPA filings and public enterprise agreements have their own registers.
3Can we start with one part?
Yes. The parts share one record, so an organisation can start with the risk register or with compliance and add internal audit or the board later.
4How are the Auditor-General's findings handled?
In the same register as internal and external audit findings, followed up the same way, and matched against earlier years to show repeat findings.
5What does the assistant do in GRC?
It reads minutes, incidents and findings for risks the register does not hold yet, drafts test plans, reads evidence, lists the obligations in a permit or contract, reads certificates, checks policies, writes findings up in standard form and drafts the committee commentary. Everything it writes is a draft for a person to adopt.
6How does it reach the board?
Any register can be frozen as it stands and sent into a meeting pack as a numbered paper, so the committee reads the figures as they were on the day, whatever has moved since.