Legal, Risk & Compliance · Module
GRC
Obligations, frameworks, controls and evidence, with failed tests turned into fixes
GRC manages obligations, frameworks, controls, testing, evidence, compliance audits and vendor risk on the shared evidence store. Continuous monitoring reads One3's own apps and external connectors.
What it does
GRC is designed to manage compliance obligations, frameworks, controls, testing, evidence, compliance audits and third-party risk on the shared evidence store. The obligation library holds regulatory, contractual (from Contracts) and internal obligations with source citation, applicability by entity, state and sector, owner and effective dates. Frameworks such as ISO 27001, SOC 2, DPDP and ISO 42001 map their requirements to a common control set; framework content licensing is checked per framework.
Controls and evidence
The control register records objective, type, frequency, owner, tester, evidence requirements and linked obligations. Evidence is collected automatically from platform audit and Action logs, Identity (MFA, access reviews), Policy-as-Code decision logs, Security Center, People joiner and leaver events and Drive policies, plus external cloud, identity and code-host connectors. Control tests can be manual or automated, with sampling support.
Findings become fixes
A failed test or overdue item becomes an issue and a remediation proposal as an Action in the owning app, such as revoking access, updating a vendor or pausing a campaign, executed by that app's approver at its own risk tier. The compliance calendar tracks filings, returns and licence renewals, with India central and state statutory items tied to People, Finance and Company Secretarial events.
Audits, vendors and trust
At GA, a compliance audit workspace handles scope, PBC requests and evidence sharing with an external auditor portal. Vendor risk covers tiering, portal questionnaires, document collection, scoring, reviews and KYB links, with vendors reusing an answer library. A trust centre publishes certifications, policies and sub-processors with NDA-gated access. Security questionnaires are drafted from approved knowledge and evidence with citations. Regulatory engagement, posture scores, a compliance incident register and training requirements are also planned.
One3 plans to run its own ISO 27001 and ISO 42001 evidence in GRC before release. Planned for W4 (Year 3).
Features
What GRC includes
Obligation library
Regulatory, contractual and internal obligations with source citation, applicability, owner and effective dates.
Framework library and cross-mapping
ISO 27001, SOC 2, DPDP, ISO 42001 and custom frameworks mapped to a common control set (licensing to verify).
Control register
Objective, type, frequency, owner, tester, evidence requirements and linked requirements.
Automated evidence collection
Platform logs, Identity, policy decisions, Security Center, People events, Drive and external connectors.
Control tests
Manual and automated tests with procedures, results and sampling.
Compliance calendar
Filings, returns and licence renewals tied to People, Finance and Company Secretarial events.
Issues and remediation Actions
Failed tests become remediation proposals executed in the owning app with approval.
Policy management and attestations
Policy documents, versions, review cycles and attestation campaigns.
Compliance audit workspace
Audit period, scope, PBC requests and an external auditor portal.
Vendor risk
Tiering, questionnaires, document collection, scoring, reviews and reusable vendor answers.
Trust centre
Public or NDA-gated page with certifications, policies and sub-processors.
Security questionnaire answering
AI-drafted answers from approved knowledge and evidence with citations and reviewer approval.
Compliance incidents and posture
Incident register with reportability decisions, framework assessments and posture scores.
Tenant Fact Register
Tenant facts with owner, source, expiry and blocked decisions.
Workflow
Continuous control monitoring
- 1
Evidence is collected on schedule
- 2
Automated tests record pass, fail or exception
- 3
Failures create issues
- 4
A remediation is proposed in the owning app
- 5
The owning app's approver executes it
- 6
The control is retested
Workflow
Vendor risk review
- 1
Vendors are tiered
- 2
Questionnaires go out through the portal and reusable answers are pulled in
- 3
Documents such as certificates and insurance are collected
- 4
A gap summary is prepared with citations
- 5
An analyst approves the rating
AI
AI skills and Digital Employees
Continuous control monitoring
Scheduled evidence collection and deterministic test execution with gap alerts.
Evidence summaries
What the evidence shows, with evidence ids, for reviewers.
Framework cross-mapping
Suggests requirement-to-control mappings for analyst approval.
Remediation drafting
Drafts remediation proposals for owning apps.
Regulatory watch
Advisory impact summaries from licensed or permitted sources.
Digital Employees that use this module
- AI Compliance Monitor
- AI Regulatory Watch Analyst
- AI Vendor Onboarding & Compliance Specialist
- AI Access Reviewer
They act through the same governed Actions as people; risky steps wait for approval.
Frequently asked questions
Which frameworks are included?
ISO 27001, SOC 2, DPDP, ISO 42001 and custom frameworks are planned. Framework text licensing must be verified for each.
Does it replace screenshots for audits?
That is the aim. Evidence comes from platform logs and connectors as work happens, and auditors review it in a scoped portal.
Can a GRC agent revoke access itself?
No. It proposes remediation; the owning app executes it at its own risk tier with approval.
See GRC in your workflow
Tell us about your team and the outcomes you want. We will walk you through the apps, the Digital Employees and the plan for your industry.