Audit & Regulatory Controls Risk Management

Continuum GRC provides a risk-based approach to Audit and Regulatory Controls Management and consolidates the entire process within a single source of truth. Supporting ALL the frameworks and standards the world has to offer such as StateRAMP, FedRAMP, CMMC, HIPAA, 800-53, CJIS, DFARS, SOC 1, SOC 2, ISO 27001, NERC CIP, SOX 404, PCI, EUCS, C5 and more.

Please visit the Audit & Regulatory Controls Risk Management page for more information.

NIST Special Publication 800-30

NIST Special Publication 800-30 provides guidance for conducting risk assessments of federal information systems and organizations, amplifying the guidance in Special Publication 800-39. Risk assessments, carried out at all three tiers in the risk management hierarchy, are part of an overall risk management process—providing senior leaders/executives with the information needed to determine appropriate courses of action in response to identified risks. In particular, provides guidance for carrying out each of the steps in the risk assessment process (i.e., preparing for the assessment, conducting the assessment, communicating the results of the assessment, and maintaining the assessment) and how risk assessments and other organizational risk management processes complement and inform each other.

Special Publication 800-30 also provides guidance to organizations on identifying specific risk factors to monitor on an ongoing basis, so that organizations can determine whether risks have increased to unacceptable levels (i.e., exceeding organizational risk tolerance) and different courses of action should be taken.

Modules include:

• NIST Special Publication 800-30 - Risk Management Guide for Information Technology Systems

ISO/IEC 27005

The ISO/IEC 27005 is applicable to all types of organizations (e.g. commercial enterprises, government agencies, non-profit organizations) which intend to manage risks that can compromise the organization's information security. This module supports the general concepts specified in ISO/IEC 27001 and is designed to assist the satisfactory implementation of information security based on a risk management approach.

Modules include:

• ISO/IEC 27005:2018 Information technology — Security techniques — Information security risk management

ISO/IEC 31000

The ISO/IEC 31000 provides principles, a framework and a process for managing risk. It can be used by any organization regardless of its size, activity or sector.

Modules include:

• ISO/IEC 31000:2018 Risk management – Guidelines

COSO Enterprise Risk Management Integrated Framework

​​​The framework defines essential enterprise risk management components, discusses key ERM principles and concepts, suggests a common ERM language, and provides clear direction and guidance for enterprise risk management.

Internal Audit and Financial Controls Management helps drive an agile and risk-based internal audit and financial controls management program that is aligned with your overarching risk management framework and business strategy. Continuum GRC allow you to seamlessly adopt established industry standards, frameworks, and best practices to simplify associated processes, enhance productivity, and facilitate better collaboration across teams. Streamline the processes for end-to-end audit management; from audit planning to execution, review, and analysis of audit findings, creation of the final audit report, and more, as well as SOX surveys and certifications. Powerful analytics and reporting tools and graphical dashboards provide real-time insights into audit findings, the status of controls, and SOX compliance, helping you make informed decisions and protecting your organization from risks.

Modules include:

• COSO ERM

Third-Party Risk Assessments

A third-party risk assessment is an analysis of vendor risk posed by an organization's third-party relationships along the entire supply chain, including vendors, service providers, and suppliers. Risks being considered include security risk, business continuity risk, privacy risk, and reputational risk.

Modules include:

• Site Visit Security Risk Assessment
• Third-Party Risk Assessment & Management
• Physical Security Risk Assessment
• Vendor Risk Management
• Use our creation tools to build your own!

Environmental, Social & Governance (ESG)

Continuum GRC's ESG Management provides assessment, auto-mapping, monitoring, reporting, and quantification of the organization's environmental, social, and governance programs. Leadership then has a complete and aggregated view of the organization's value chains, as well as its supply chain's ability to meet its social and sustainability responsibilities.

Executives and Board members can use Continuum GRC's ESG Management's graphical, real time reporting and dashboards to view and evaluate compliance, environmental impact, and supply chain risk with quantifiable data and metrics. This actionable data helps inform better decision-making and achievement of corporate goals, while mitigating risk and ensuring the business takes steps to ensure its success.

Continuum GRC's ESG Management enables environmental, social, and governance (ESG) data to be gathered and integrated directly into the Continuum GRC IRM platform. Business leaders and executives have access to quantifiable risk data that provides the insight and tools needed to protect the business while adhering to their ESG policies.

Modules include:

• GRI: The GRI Standards represent global best practice for reporting publicly on a range of economic, environmental and social impacts. Sustainability reporting based on the Standards provides information about an organization’s positive or negative contributions to sustainable development.
• SASB: The SASB Standards identify the subset of environmental, social, and governance issues most relevant to financial performance in each of 77 industries. They are designed to help companies disclose financially-material sustainability information to investors.

• ESG Self-Assessment: A self-assessment tool for corporate directors, designed to provide guidance to the board on how it is integrating ESG matters into its oversight role. It is not an evaluation of the board’s overall effectiveness, professionalism, or impacts. The multiple-choice questionnaire evaluates the board's integration of sustainability across five core areas that are Purpose & business model, Risk management, Engagement with management, Engagement with stakeholders and Non-financial reporting.

• ESG Risk Assessment: The ESG risk assessment is the best way to ensure success from start to finish. By objectively identifying ways in which you’re already in line with ESG best practices, you can better evaluate the risks to your ESG status. Use our risk assessment to evaluate your ESG risks and automatically generate a dashboard to display your findings to upper management, the board or other key stakeholders.

COSO Enterprise Risk Management Integrated Framework

​​​The framework defines essential enterprise risk management components, discusses key ERM principles and concepts, suggests a common ERM language, and provides clear direction and guidance for enterprise risk management.

Internal Audit and Financial Controls Management helps drive an agile and risk-based internal audit and financial controls management program that is aligned with your overarching risk management framework and business strategy. Continuum GRC allow you to seamlessly adopt established industry standards, frameworks, and best practices to simplify associated processes, enhance productivity, and facilitate better collaboration across teams. Streamline the processes for end-to-end audit management; from audit planning to execution, review, and analysis of audit findings, creation of the final audit report, and more, as well as SOX surveys and certifications. Powerful analytics and reporting tools and graphical dashboards provide real-time insights into audit findings, the status of controls, and SOX compliance, helping you make informed decisions and protecting your organization from risks.

Modules include:

• COSO ERM

IT & Cybersecurity Risk Identification, Assessment, Analysis, and Mitigation

Continuum GRC IT and Cyber Risk Management software empowers organizations to adopt a focused, business-driven approach to managing and mitigating IT and cyber risks. Organizations conduct IT risk assessments, implement controls, and take necessary mitigation actions. Advanced cyber risk quantification capabilities help quantify cyber risks. Sophisticated analytics and reports transform raw risk data into actionable IT risk intelligence, providing clear visibility into the top cyber risks affecting the organization.

Please visit the IT & Cybersecurity Risk Management page for more information.