SmartSuite for the GRC Platform Administrator

Compliance management. Builds control libraries, framework mappings and testing workflows with configurable templates and automation.

Risk management. Configures scoring models, registers and KRIs to the program's methodology.

Issues and actions. Sets up the shared issue register, routing rules and escalation automations.

Reporting. Creates role-based dashboards and reports for every program owner.

What does a GRC Platform Administrator own?

The GRC Platform Administrator configures and runs the GRC platform: the data model, workflows and automations; users, roles, permissions and access reviews; the framework and regulatory libraries; dashboards and reports for program owners; integrations with HR, IT, finance and security systems; and the change control, testing and release of configuration changes. They train users and keep the documentation current. Because the platform holds control evidence, its own change and access controls are IT general controls tested under SOX and SOC 2, so the administrator's discipline is itself audited.

How does SmartSuite help a GRC Platform Administrator build control libraries?

SmartSuite builds control libraries, framework mappings and testing workflows with configurable templates and automation, so the administrator sets up a control program by configuring templates rather than writing code. Control Framework & Regulatory Libraries holds the frameworks the controls map to, and Compliance Assessments & Testing runs the testing workflows the administrator configures for the Compliance Director. When the program changes its testing approach, the administrator changes the template and the workflow, and the change goes through the platform's own change control.

How does the administrator configure risk scoring to the program's methodology?

SmartSuite lets the GRC Platform Administrator configure scoring models, registers and KRIs in Enterprise Risk Management (ERM) to the program's methodology, so the Enterprise Risk Director's scoring scale, assessment templates and indicator definitions are implemented as configuration rather than approximated. If the methodology changes, the administrator updates the scoring model and the registers follow. The administrator translates the requirement into configuration; the Enterprise Risk Director owns the methodology, and the two work from a shared specification.

How is the shared issue register and its routing set up?

The GRC Platform Administrator sets up the shared issue register, its routing rules and the escalation automations in Issues Management, so findings from audit, compliance, risk and third-party programs land in one register and are routed to the right owner with escalation when they stall. The Issue and Action Management Lead defines the rules and the administrator configures them. Because every program writes to the same register, the administrator maintains one set of routing rules rather than one per program.

How does a GRC Platform Administrator deliver dashboards to each program owner?

SmartSuite creates role-based dashboards and reports for every program owner, so the Compliance Director, the Enterprise Risk Director and the Issue and Action Management Lead each see their program's status without the administrator building a bespoke report for each request. The administrator sets up the role-based views once, and the reports draw on the live records. Requests for new views become configuration changes that go through the same change control as the rest of the platform, with the documentation updated alongside.

What does a new GRC Platform Administrator need to get the platform running?

The program requirements from each owner: the control library and framework mappings from the Compliance Director, the scoring methodology from the Enterprise Risk Director, the issue routing rules from the Issue and Action Management Lead and the roles and permissions model from the access policy. With those specified, the administrator configures the templates, registers and dashboards and runs the first program cycles. The IT Service Manager and the Systems Administrator are the partners for integrations and change control, and the Chief Risk Officer or Chief Information Officer owns the platform.