Risk
Know which risks need attention.
Every risk is rated before and after its controls and checked against the appetite and tolerance you agreed. Its treatment needs approval, never from the person who owns the risk.
Most GRC tools keep a separate register for each job. AlignX brings them together, so you can see which controls meet each requirement, who approved each risk and whether each finding is really fixed, without piecing it together for every audit.
You have the registers. You don't have the answers.
The answers are usually there. They just take too long to find, piece together and check.
Which controls meet this requirement?
Each framework keeps its own copy of the control, so nobody is sure which one is current.
Who accepted this risk, and on what authority?
The decision is in the minutes somewhere. Why it was made, and who was allowed to make it, often isn't.
Has this finding actually been fixed?
An action marked complete doesn't prove the fix worked.
So assurance gets pieced together again before every audit.
How assurance comes together
Start with what you have to meet. Connect your policies, controls and risks to it. Then follow the decisions and findings that show what was done.
- FrameworkThe standards you answer to, down to each requirement.
- PolicyYour policies and standards, each with an owner and a review date.
- ControlWritten once, mapped to every framework that needs it.
- RiskRated before and after controls, and checked against your appetite.
- AssessmentThe checks you run, and the evidence behind each answer.
- DecisionWhat was decided, why, and who had the authority.
- IssueWhat went wrong, who's fixing it, and the check that it's fixed.
Know what needs attention. Show what's been done.
Risk, compliance and audit work from the same records, so the board hears one answer.
Controls and frameworks
Write a control once. Use it for every framework.
One control library, mapped to the requirements of each framework you answer to.
Policies
Keep every policy owned and up to date.
Policies, standards, procedures and guidelines, each with an owner, an approving committee and a review date, and a set approval.
Committees and decisions
Know who decided, and whether they could.
Every decision keeps its reason, the authority it was made under and the meeting it came from. Once ratified, it's locked.
Assessments and issues
Close findings on evidence, not on say-so.
Evidence is fingerprinted when it's uploaded, and a finding only closes once its fix has been checked.
What the auditor will ask for, already on the record.
Assurance that keeps up with the business
Closed means done
A finding closes only after its fix is checked.
One control, many frameworks
A control that meets three frameworks is kept once, not three times.
Decisions you can explain
What was decided, why and on whose authority is on the record, and can't be quietly changed.
Governance shouldn't be something you prepare for. It should be how the work gets done.
Start with the registers you already keep
You don't need a new compliance programme to start.
- Bring it inYour risk register, controls and policies, moved across rather than retyped.
- Map one frameworkStart with the one you're audited against. Link your controls to it and see where they overlap.
- Run one real reviewA risk review, a policy approval or an audit finding. The record gets better with each one.
Built inside your Microsoft 365. Your data. Your controls. Your evidence.
Questions risk and audit leads ask
Less. Evidence is attached to the assessment answer it supports when it's collected, with who provided it, when, and a fingerprint taken at upload. The file stays in your SharePoint.