Risks and the heat map
Risks with owner, score and mitigations; a probability and impact heat map, periodic reassessment.
Governance & Systems
Governance & RiskRisks, controls and audit findings tracked until they are closed.
Enterprise risks and the heat map, internal controls and their tests, internal audits, policies, risk action plans, loss events and anomaly monitoring in one app.
- 3 sub-modules
- 24 modules at the same price
What is it, and why do you need it?
What is Governance & Risk for?
When the risk list lives in a spreadsheet updated once a year and audit findings stay in a report, nobody knows whether the actions were closed until the next audit.
Governance & Risk links every risk to its owner and score, every control to its test and every finding to its action. Anomaly monitoring continuously scans transaction data for rule violations.
Scope: Runs the risk matrix, controls, audits and compliance (governance) processes.
Highlights
What do you do with Governance & Risk?
Internal control
Controls that mitigate risks and their owners; control tests and their results.
Internal audit
Audit planning and execution; findings are tracked with corrective actions until closure.
Policies
Corporate policies are published and acceptance is tracked.
Loss events
Loss and breach events are recorded and their resolution is tracked.
Anomaly monitoring
Rule violations and anomalies in transaction data are monitored continuously.
Sub-modules
Governance & Risk: 3 sub-modules
This list is generated from the product itself; it grows as new functions are added to a sub-module. Master data and settings are the shared ground of every module and are not counted as sub-modules.
Business Continuity
- Business ContinuityBusiness continuity: business impact analysis of processes (RTO · RPO · MTPD), recovery plans (steps · communication · annual review) and exercises (target × actual, finding → action).
Security Operations
- Security IncidentsInformation security incidents: NIST phases from detection to closure, response playbook tasks by category, indicators of compromise, the KVKK 72-hour notification for personal data breaches, actions and the IT incident.
- Vulnerability ManagementVulnerability management: severity from CVSS, remediation deadline from severity, scanner output import, remediation tracking and time-limited risk acceptance.
Risk & Controls
- RisksRecords corporate risks; tracks them with owner, score and mitigations. The Matrix view shows risks on a heat map along the likelihood and impact axes; the Assessment section re-assesses risks periodically and updates their scores.
- ControlsDefines the internal controls that mitigate risks and assigns their owners; the Tests section tests the operating effectiveness of the controls and records the results.
- AuditsPlans and runs internal control and compliance audits and tracks their findings.
- Corporate PoliciesPublishes corporate policy documents and tracks acceptance status.
- ActionsTracks corrective actions linked to risk and audit findings.
- Loss EventsRecords GRC risk and compliance events (loss, breach) and tracks their resolution.
- Anomaly MonitoringContinuously monitors rule violations and anomalies in transaction data.
On the same data
Governance & Risk works together with these
Modules are separate screens, but the data is one: a record entered in one module is never re-entered in another.
Admin
Users, permissions, definitions and integrations on one admin screen.
Legal & Contracts
No missed contract expiry, no missed hearing.
Board of Directors
Board decisions, shareholders and dividends on record.
Zenoheld Accounting
In the journal the moment the invoice is issued; no waiting for month end.
Frequently asked
About Governance & Risk
Who closes audit findings?
Every finding is linked to an action plan and its owner; it stays on the open list until the action is closed.
Can employees' acceptance of policies be tracked?
Yes. A policy is published, and who has accepted it is listed.
What data does anomaly monitoring look at?
The transaction data across all modules; a record is created when a defined rule is violated.
Close next month end without a reconciliation marathon.
Try it free for 15 days; no credit card needed. We reply to your questions within one business day.