Domain
Governance
This directory contains the enterprise-wide governance foundation of the GRC Documentation Library: the library charter, document architecture, cross-framework alignment, role authority, terminology, metrics, and the overarching policies for governance, risk, and exception management.
Note
Its original content is released under CC BY-SA 4.0; a quotation that NOTICE.md (opens in a new tab) allows or keeps under its transition clause keeps its source licence and is not relicensed under CC BY-SA 4.0.
Principle, 3
Principles
Charter, 1
Charters
Policy, 2
Policies
Framework, 7
Frameworks
- Continuous Assurance and Improvement Frameworkv1.1.10
- Document Architecture and Interrelationship Frameworkv1.1.6
- Governance Performance and Improvement Frameworkv1.0.16
- Governance Relationship and Flow Modelling Frameworkv1.0.8
- Human Capital and Ethical Conduct Frameworkv1.0.13
- Metrics, Monitoring and Performance Reporting Frameworkv1.1.14
- Sustainability and Responsible Technology Frameworkv1.2.6
Standard, 5
Standards
Specification, 3
Specifications
Procedure, 5
Procedures
Guideline, 2
Guidelines
Matrix, 2
Matrices
Register, 9
Registers
- AI Security Tooling Landscape Registerv1.1.14
- Canonical Citations Registerv1.6.22
- Coverage Gap Analysis Registerv1.1.53
- Data Retention Schedulev1.1.2
- Digital Trust and Assurance Metrics Registerv1.1.5
- Document Index and Classification Registerv1.27.238
- Glossary and Acronym Indexv1.4.26
- Key Terms and Definitions Registerv1.2.3
- Role Authority Registerv1.7.1
Template, 4
Templates
Leadership, 15
Leadership pages for this area
Pages from the executive layer that tag this area. They explain and advise; the documents above govern.
- Choosing between human review, human oversight, and autonomous authority for AI-assisted workdecision narrative
- Choosing how much cloud and supplier concentration to accept and what exit readiness to maintaindecision narrative
- What the governing body should require before an AI system goes into productionexecutive brief
- What the governing body should require for AI data governance and classificationexecutive brief
- What the governing body should require for workforce, conduct, and operating-model oversightexecutive brief
- What the governing body should require to know its enterprise risk is governedexecutive brief
- From AI idea to retirement: the governed life of an AI systemjourney
- From retention rule to destruction evidence: the governed journey of a recordjourney
- How leadership can know, with evidence, whether the controls it relies on are operatingoutcome map
- How leadership can know, with evidence, whether the organization's legal and regulatory obligations are identified and metoutcome map
- What the governing body should ask about enterprise architecture and accumulated technology debtoversight question set
- What the governing body should ask about risk appetite, the register, acceptances, early-warning indicators, and board reportingoversight question set
- What the governing body should ask about the organization's AI inventory, risks, incidents, suppliers, and changeoversight question set
- What happens when a monitored risk breaches the appetite the governing body setscenario
- When an AI agent acts beyond its granted authorityscenario
Next on the tour
Open a domain: Compliance