Challenges
- Legacy Navigation Model: Users navigated the legacy system through a familiar content tree, while flat lists and filters were an unfamiliar model.
- Fragmented Processes: Risk, compliance, audit and evaluation teams each ran their own processes in the legacy system and spreadsheets, with no shared view of risks, controls or issues.
- Repeated Assessments: The same controls were assessed repeatedly by different teams, inflating effort and producing inconsistent results.
- Inconsistent Issue Tracking: Issues and remediation actions were tracked inconsistently. Ownership, deadlines and closure evidence were difficult to demonstrate.
- Email-Based Handovers: Handovers between the three lines of defence relied on email, making accountability and segregation of duties difficult to evidence.
Solution Delivered
- Familiar Navigation: A tree view of the full risk and audit taxonomy, preserving the navigation users already knew and removing the biggest barrier to change.
- Unified Operating Model: A single operating model for the three lines of defence, with business, risk management and audit working from the same risk, control and issue records.
- Single Self-Assessment Cycle: One self-assessment cycle per business area, assessed once, with results shared rather than reattested.
- Standardized Issue Lifecycle: A standardized issue lifecycle from triage through remediation to closure, with clear ownership at every step.
- End-to-End Audit Lifecycle: The full audit lifecycle, including planning, engagements, testing and observations, brought onto the same platform.
Benefits & Outcomes
- Shared Taxonomies: Improved governance through standardized and shared taxonomies.
- Eliminated Duplicate Attestation: Duplicate attestation was eliminated across the three lines of defence.
- Clear Accountability: Each line sees and does only what its mandate allows, strengthening accountability and segregation of duties.