Governance, Risk and Compliance Business Information Model: AI-Ready Edition

Governance, Risk and Compliance Business Information Model: AI-Ready Edition sets out the information the governance, risk and compliance function works with, so architects and transformation leads in financial services firms can see what an AI agent would read and how carefully it must be handled: 16 subject areas, 115 entities, 838 key attributes and 377 relationships. Every entity and key attribute has a sensitivity class, the AI uses it serves and the data-quality requirements an agent relies on. It is the information model inside Governance, Risk and Compliance Business Architecture Package: AI Transformation Blueprint, sold separately.

Subject Areas

16 subject areas group the 115 entities.

• Board, Entities & Delegated Authority (7 entities). Scope: How the organization is directed and who may decide what: board and governance body meetings, their papers and recorded decisions, delegated authority, and the legal entities with their statutory filings.
• Policies & Exceptions (4 entities). Scope: The enterprise policy library and its use: each policy, its approved versions, the exceptions granted against it and the acknowledgments people give.
• Risk Framework & Appetite (5 entities). Scope: The frame every risk decision works within: the risk categories, the risk appetite statements and the limits that make them measurable, the authority levels that say who may accept which risk, and the assessments of risk culture.
• Enterprise Risks & Risk Decisions (6 entities). Scope: The enterprise risk register and the decisions taken on it: each risk, its assessments, self-assessments by the business, risks submitted by specialist functions, treatment plans and risk acceptances.
• Risk Monitoring, Events & Scenarios (6 entities). Scope: How risk is watched over time: key risk indicators and their readings, breaches of appetite, risk events and losses, emerging risks and scenario analyses.
• Obligations & Requirement Change (7 entities). Scope: What the organization must do and how that changes: the applicable requirements, the obligations derived from them and where each applies, retention requirements, and requirement changes with their impact assessments and plans.
• Compliance Monitoring, Breaches & Attestation (6 entities). Scope: How compliance is checked and reported: the compliance plan, monitoring activities, compliance tests, suspected breaches, breach determinations and attestations.
• Supervisory Authority Engagement (5 entities). Scope: The organization's dealings with supervisory authorities: the authorities it deals with, their inquiries, the submissions it must make, the commitments it gives and its decisions on voluntary disclosure.
• Controls, Testing & Issues (9 entities). Scope: Internal control from design to remediation: the processes controls sit in, the controls, self-assessments, segregation of duties conflicts, control tests and evidence, deficiencies, issues and the actions that close them.
• Internal Audit (9 entities). Scope: Internal audit, independent of management: the audit universe, the audit plan, engagements, work records, audit evidence, findings, reports, the overall opinion and quality reviews.
• Legal Matters, Advice & Contracts (10 entities). Scope: The legal function's work: requests for legal help, legal matters, legal advice and positions, legal holds, matter documents, outside counsel, standard contract terms, contract reviews and corporate transactions.
• Privacy (9 entities). Scope: The privacy program: the record of processing activities, privacy notices, privacy impact reviews, high-risk processing decisions, transfer safeguard assessments, personal data requests, privacy incidents, harm assessments and notification decisions.
• Ethics, Speak-Up & Investigations (10 entities). Scope: Ethics and integrity: conduct standards, speak-up reports, reporter protection, investigations with their evidence, findings and referrals, conflict of interest declarations, gifts, hospitality and donations, and restricted party screening.
• Third Parties (6 entities). Scope: Third parties as sources of risk: each third party, the relationships the organization has with it, due diligence assessments, third-party risk decisions, exceptions to the method and exit plans.
• Resilience, Continuity & Crisis (9 entities). Scope: Keeping critical business services running: the services, their dependencies, business impact analyses, recovery requirements, continuity plans, exercises, crisis records, crisis decisions and crisis communications.
• AI & Digital Labor Governance (7 entities). Scope: The governance of AI in governance, risk and compliance: AI systems and agents, agent action logs, records of AI-assisted decisions, model validations, human reviews and each agent's authority limits.

In the Download

Three files carry the same model: the full model in Word, a workbook for analysis and a guide.

• For each of the 115 entities: definition, typical system of record, sensitivity class, AI uses and data-quality requirements
• 838 key attributes rated for sensitivity and AI relevance, and 377 relationships with cardinality
• The capabilities that need each entity and the agents that read it, by name and ID
• Business Data Model (Word), every subject area and entity in full
• Workbook (Excel), with subject areas, entities, attributes and relationships to filter and extend
• Guide (Word), covering the scales, the data foundation and the license
• Corrections free of charge, and new versions free for 180 days after purchase

Your organization's name and license ID are printed in every file.

Who It Is For

Data owners and stewards, data architects, and the AI and analytics engineers who decide what an agent may read, how sensitive it is and what quality it needs first; and architects connecting capabilities to data.

With the Other Editions

The capabilities listed under each entity are defined in the Governance, Risk and Compliance Capability Matrix: AI-Ready Edition. Governance, Risk and Compliance Business Architecture Package: AI Transformation Blueprint contains this model, specifies the agents and adds the value streams, use cases, controls, operating model and roadmap. The Governance, Risk and Compliance Value Stream Catalog is sold on its own as well.