ORSA · OPERATIONAL RISK
What can go wrong in the work
The self-assessment starts from the processes and their possible failures, at the task where they appear.
xGRC · compliance and standards
From the source text to the score, with nothing broken in between.
Elsewhere, a regulation is read, commented on in a document, and then someone re-keys by hand the risks they inferred from it. Three tools, three formats, three moments. The chain breaks at every step, and traceability breaks with it.
In e-Beyonder the text is not a document attached to the framework. It is the raw material of it.
The screens below are non-contractual representations, stripped down to isolate the mechanism. Real screens carry a density of structured data we do not publish — you will see them in a demonstration.
DECLARATIVE FRAMEWORK
The text lives in a folder. The analysis lives in a memo. The risks live in a register. Nothing connects the three except the memory of whoever did the work.
Supervisor's question: "show me the article this risk comes from." Answer: a search.
EXECUTABLE FRAMEWORK
The text is an object in the system, versioned and attached to the processes it binds. Compliance risks are derived from it and keep the link to the article behind them.
Same question. Answer: opening a page.
The chain
Five steps, one system.
None of the five asks anyone to re-key what the previous one produced. That is what "nothing broken in between" actually means — and it is what makes the chain defensible end to end.
-
01
Source text
Law, regulation, standard, IT standard, client specification. Versioned, attached to the processes it binds.
-
02
Assessment
The text becomes a compliance risk assessment questionnaire, addressed where the obligation applies.
-
03
Automatic creation
Non-compliance risks are created by the system, not re-keyed. Each keeps the link to the article behind it.
-
04
Brought under control
Each risk gets its controls, which execute on exactly the same mechanics as operational controls.
-
05
Score
Gross, then net from the measured performance of the controls. Compliance stops being an assertion.
01 — 03 · the text becomes risks
The article is not an attachment. It is the risk's parent.
The corpus comes in article by article. Each one is attached to the processes it binds — and that attachment is what lets the system know where the obligation applies, and therefore whom to address the assessment to.
The assessment produces compliance risks, created by the system. No one retypes them into a register: they arrive already qualified and already tied to their basis.
When the text moves to a new version, what depends on it is known. A declarative framework cannot tell you what a regulatory change has just invalidated.
02 · the two self-assessments
CRA and ORSA, one engine.
Many organisations run both self-assessments in two different tools, on two process inventories, two taxonomies and two calendars. Differences between them are then never information — only inconsistencies to explain.
CRA · COMPLIANCE RISK
What can fall short of an obligation
The self-assessment starts from the text and what it requires, where that text binds a process.
Both run on the same process inventory, the same taxonomy and the same control mechanics. An operational risk and a compliance risk pointing at the same task are visible as such — and handled once.
03 · internal policies
A policy is supposed to implement a text. Someone has to be able to check that.
Internal policies follow the same path as external texts: versioned, attached to processes as a rule set, and checked against the texts they implement.
Versioned
Every version knows which processes it applies to and since when. History is not an archive folder; it is a dimension of the object.
Aligned, or not
Alignment with the source text is verified in the system. A gap is a dated finding, not an impression from a read-through.
Operative
Attached to the process, the rule is visible where the work happens — and controllable where it can be broken.
04 · beyond regulation
If a text binds you, it belongs in the system.
The engine does not care what kind of text it is, only that it creates a verifiable obligation. So what holds for a regulation holds for what is not regulatory at all.
IT STANDARDS
Standards risk, handled like the rest
Technical standards and requirements enter the same chain, attached to the IT assets concerned, through to the score.
CLIENT SPECIFICATIONS
A commercial commitment is an obligation
A client specification is assessed like any text: what you promised becomes controllable, and a shortfall becomes visible before the complaint arrives.
CONTRACTED SERVICE
Critical providers, same regime
Obligations carried by a third party are instructed in the same chain, because the mechanism is the same: a text, a process it binds, a control.
05 · where the chain lands
Compliance risk is not a register of its own.
Once created and brought under control it is scored like any other: gross, then net from the measured performance of its controls. It rolls up through the taxonomy, and from there into the exposure map of the whole organisation.
That is what makes it possible to answer a question few organisations can handle: not "are we compliant", but by how much, where, and against which text.
Compliance stops being an annual assertion. It becomes a measurement, as at today.
Bring one article. We will produce its risks in front of you.
A text that binds you, and the processes it touches. You will watch the chain being built — text to score — without a single risk being retyped.