SmartSuite for the GRC Platform Administrator

Load regulatory and framework libraries into Control Framework & Regulatory Libraries once and map controls across them, so when a framework version changes you update the mapping rather than rebuild the program.

Users, roles and granular permissions are managed centrally with activity logs, so the periodic access reviews ISO 27001 or SOC 2 expect are run from the record of who can see and change what.

Intake forms, routing rules, reminders and escalation automations are built by you in the no-code environment, so a program owner's new requirement is live without an engineering ticket.

Because compliance, risk, audit, third-party and policy programs share one data model, a field, workflow or template you change once is consistent for the Compliance Director and the Enterprise Risk Director alike.

Configuration changes are raised, tested and released through a change workflow shared with the IT Service Manager, so the platform's own change management stands up as an IT general control.

Platform documentation, training materials and release notes are held as records linked to the configuration they describe, so users and the Systems Administrator find the current guidance beside the thing it explains.

Every configuration change, permission change and automation edit is logged with who and when, so when SOX or SOC 2 testers examine the platform as an ITGC the evidence is already there.

SSO, 2FA, encryption and granular permissions protect control evidence and risk data, which matters where the platform holds PHI under HIPAA or data covered by NYDFS rules.

New business units, regions or frameworks are added to the existing structure rather than built again, so growth in the GRC program is configuration work for you rather than a migration project.

Chief Risk Officer

The GRC Platform Administrator configures and runs the GRC platform: the data model, workflows and automations; users, roles, permissions and access reviews; the framework and regulatory libraries; dashboards and reports for program owners; integrations with HR, IT, finance and security systems; and the change control, testing and release of configuration changes. They train users and keep the documentation current. Because the platform holds control evidence, its own change and access controls are IT general controls tested under SOX and SOC 2, so the administrator's discipline is itself audited.

SmartSuite builds control libraries, framework mappings and testing workflows with configurable templates and automation, so the administrator sets up a control program by configuring templates rather than writing code. Control Framework & Regulatory Libraries holds the frameworks the controls map to, and Compliance Assessments & Testing runs the testing workflows the administrator configures for the Compliance Director. When the program changes its testing approach, the administrator changes the template and the workflow, and the change goes through the platform's own change control.

SmartSuite lets the GRC Platform Administrator configure scoring models, registers and KRIs in Enterprise Risk Management (ERM) to the program's methodology, so the Enterprise Risk Director's scoring scale, assessment templates and indicator definitions are implemented as configuration rather than approximated. If the methodology changes, the administrator updates the scoring model and the registers follow. The administrator translates the requirement into configuration; the Enterprise Risk Director owns the methodology, and the two work from a shared specification.

The GRC Platform Administrator sets up the shared issue register, its routing rules and the escalation automations in Issues Management, so findings from audit, compliance, risk and third-party programs land in one register and are routed to the right owner with escalation when they stall. The Issue and Action Management Lead defines the rules and the administrator configures them. Because every program writes to the same register, the administrator maintains one set of routing rules rather than one per program.

SmartSuite creates role-based dashboards and reports for every program owner, so the Compliance Director, the Enterprise Risk Director and the Issue and Action Management Lead each see their program's status without the administrator building a bespoke report for each request. The administrator sets up the role-based views once, and the reports draw on the live records. Requests for new views become configuration changes that go through the same change control as the rest of the platform, with the documentation updated alongside.

The program requirements from each owner: the control library and framework mappings from the Compliance Director, the scoring methodology from the Enterprise Risk Director, the issue routing rules from the Issue and Action Management Lead and the roles and permissions model from the access policy. With those specified, the administrator configures the templates, registers and dashboards and runs the first program cycles. The IT Service Manager and the Systems Administrator are the partners for integrations and change control, and the Chief Risk Officer or Chief Information Officer owns the platform.