Governance, Risk and Compliance Capability Matrix: AI-Ready Edition

The Governance, Risk and Compliance Capability Matrix gives risk, compliance, audit and legal teams one map of the oversight work they share, with a rating of where AI can help in each part of it. Architecture and transformation teams at banks, insurers, asset and wealth managers and payments firms use it as the business view under their oversight programs. The content is cross-industry and describes the work itself, not any rulebook. It holds 227 L3 capabilities in 10 areas, from corporate governance support to operational resilience, with 197 KPIs. Each of the 48 L2 capabilities carries an AI profile with a target AI mode, an oversight level and a risk tier.

The Problem Behind It

In a large firm the oversight functions tend to grow separately. Risk keeps a taxonomy, compliance keeps an obligations register, internal audit keeps an audit universe, and legal and privacy keep their own records. Each describes overlapping work in its own terms. When a board committee asks what each function covers and how it is measured, someone has to assemble the answer by hand from several inventories.

AI proposals for these functions arrive in the same scattered way: a tool that summarizes new requirements, a control-testing assistant, a contract reviewer in legal. Each one changes who reads, compares and concludes, inside the functions whose job is to check conclusions. The matrix gives every proposal the same frame. A reviewer can see which capability a tool touches, what oversight level the profile sets and which decision stays with a named person, before the purchase is approved.

What it is

Inside the Governance, Risk and Compliance Capability Matrix

Ten L1 areas organize the matrix: corporate governance support, enterprise risk, compliance, internal control, internal audit, legal services, privacy, ethics and conduct, third-party risk and operational resilience. Below them sit 48 L2 and 227 L3 capabilities. Every L3 has a definition, and the L2 capabilities carry 197 KPIs between them. The IDs are stable, so a control library, an audit plan and an investment case can cite the same capability by the same code.

The capabilities name activities, not obligations. Reading a new requirement, mapping it to controls, testing the controls and reporting the result are the same kinds of work wherever a firm operates, so the matrix keeps its shape when the rules change. Linking each capability to the requirements that apply to you is a task for your own compliance specialists.

Each L2 profile records the opportunity for AI, the work that stays with people, the agents and data involved, the prerequisites, the risks and the effect on staff, and sets a target AI mode, an oversight level and a risk tier. Each L3 is rated separately for work pattern, AI mode, AI fit and risk tier, and capabilities that inform a decision about a person are flagged. Compliance obligations management (GR-3.1) shows the result: 4 for AI fit, 4 for value, 3 for feasibility and 2 for data readiness, a Moderate risk tier and a place in Wave 1, with every change to the obligations inventory approved by a named lead.

The deliverables

What the Download Contains

The Capability Matrix edition holds the oversight model, its AI ratings and the working files:

The model

• 10 L1, 48 L2 and 227 L3 governance, risk and compliance capabilities, defined through L3, with 197 KPIs set at L2

AI and governance

• For each L2 capability, an AI profile covering opportunities, what stays human, agents, data, KPIs, AI measures, prerequisites, risks and workforce impact
• L3 capabilities rated for work pattern, target AI mode, AI fit and risk tier
• Risk-adjusted scoring and ranking of each L2 capability, driven by your own ratings and weights
• An AI heatmap across the entire model
• A weighted AI readiness assessment with 40 questions

Files and terms

• To begin, a Welcome document; then the capability map deck, standalone capability definitions and KPIs documents, the Excel workbook, the user guide
• Bonus files included: a governance, risk and compliance glossary, A Practical Guide to Business Architecture, a capability modeling overview, an AI-ready capability profile template and capability relationship mapping templates
• Corrections free of charge, and new versions free for 180 days after purchase

Your organization's name and license ID are printed in every file. Ratings reflect a typical large enterprise; treat them as a first draft of your own.

Putting it to work

Use Cases

Aligning the audit universe with risk and compliance coverage. Map internal audit's universe and the compliance team's coverage to the same L3 capabilities. Work covered twice, and work nobody covers, shows up as capabilities with two owners or none.

Screening AI requests from the oversight teams. When a team proposes an AI tool for control testing, contract review or requirement analysis, find the capabilities it touches and compare the request with their target mode and oversight level. A request for more autonomy than the profile sets goes to a closer review.

Writing requirements for GRC technology. List the L3 capabilities a new GRC system must cover and the KPIs it should move, and write the requirements capability by capability. Bids are then compared on coverage of named work.

Reporting oversight coverage to the board. Use the 10 areas and their KPIs to show a board committee what each oversight function does and how it is measured. The view holds when reporting lines change, because it is built on work rather than on teams.

Scoping third-party risk and resilience work. Use the third-party risk and operational resilience capabilities to scope work that involves procurement, technology and operations as well as risk, and agree which team owns each part.

Setting AI ground rules for conduct and privacy work. Use the flags on capabilities that inform a decision about a person, together with the risk tiers, to decide where a named reviewer must see every AI output before anyone acts on it.

Who It Is For

Chief risk officers. Present enterprise risk and operational resilience to the board in one structure and choose where AI can support risk assessment first.

Chief compliance officers and compliance operations leads. Tie the obligations register and monitoring work to capability IDs and review the AI ratings for the compliance capabilities.

Internal audit leaders. Build the audit universe on the capabilities, and use the profiles to decide which AI uses in the audited functions need assurance work.

Privacy and legal operations leads. Confirm which privacy and legal services decisions stay with qualified people, and raise the oversight levels where their practice is stricter.

Enterprise architects covering risk and compliance. Connect the oversight capabilities to the applications and data that support them, and keep those links current as the GRC estate changes.

The economics

The Alternatives

Oversight functions rarely settle on a shared map by themselves, because each has a sound reason to describe its work its own way. A capability model they all accept can come from three directions.

• Building it from a blank slate. The architecture team interviews each oversight function in turn, collects its inventories, and argues out the boundaries between risk, compliance, control and audit work. Every boundary goes back for review, and only when the structure holds can anyone start rating capabilities for AI.
• Hiring consultants to build it. An advisory team can run the interviews and broker the boundary disputes from outside the reporting lines. The engagement still pays for writing the generic oversight structure, and the result stays useful only if someone inside owns it afterward.
• Starting from this model. The team opens a defined structure of 227 L3 capabilities with AI profiles, ratings and a scoring model already in place. Meetings go to deciding which function owns what, where your oversight is stricter than the ratings assume, and which AI uses come first.

The supplied ratings describe a typical large enterprise. Specialist advisers, internal or external, are best spent on what the matrix cannot know: your risk appetite, the requirements that apply to you, and how your committees divide authority.

Getting Started

These steps take an oversight team from the download to a ranked list of AI candidates:

1. Read the Welcome document and the user guide, and circulate the capability map deck to the risk, compliance, audit, legal and privacy leads.
2. Map your existing risk taxonomy, obligations register and audit universe to the L3 capabilities.
3. Record one accountable owner for each L2 capability and list the ones in dispute.
4. Change the ratings and risk tiers in the workbook where your practice differs, and set the prioritization weights.
5. Score the 40-question readiness assessment with the heads of each function.
6. Take the top-ranked capabilities, with their oversight levels, to the committee that approves AI use.

Public sample

A Sample Profile

The sample is 0.78% of the package and traces one thread through it: compliance obligations management. The fields below come from the Compliance Obligations Management (GR-3.1) AI profile:

• AI mode: Augment
• Oversight level: Human-in-the-loop
• Risk rating: Moderate
• Wave: Wave 1
• Fit, value, feasibility and data readiness scores: 4, 4, 3, 2 on a 1–5 scale
• Patterns of work: Knowledge retrieval, Analysis & insight, Judgment-based decision
• What AI could do: Read a newly identified requirement and draft its obligations in business language, each with the passage it comes from, for the Regulatory Change Lead to add to the inventory
• What people decide: The Regulatory Change Lead approves each obligations inventory change (an obligation added, changed or retired, with where it applies) on the Obligation Mapping Assistant's draft, after hearing the Legal Reviewer and the Compliance Manager; what a requirement means in law is Legal Counsel's

Upgrading Later

Buy this edition now and, if you upgrade to the Governance, Risk and Compliance Business Architecture Package: AI Transformation Blueprint within 90 days, its full price counts against the upgrade. Email your order number to support@finantrix.com for a one-time checkout code.

Read before you buy

Common Questions

Which edition fits my team?

Choose the AI-Ready Capability Model for the capability map, an AI profile for every L2 capability, prioritization, the heatmap and the readiness assessment. Choose the AI Transformation Blueprint for all of that plus value streams redesigned for AI, the business data model, agent specifications, use cases, responsible AI principles and controls, the operating model and the roadmap, a leadership presentation template, and bonus files on roles, operating model archetypes and transformation.

Can our internal AI tools use the content?

Yes, inside your organization. The Enterprise license covers internal tools, including assistants and agents you run yourselves. No license permits using the content to train, fine-tune or prompt AI systems on behalf of third parties.

Does it address AI laws and regulations?

No. The content is business architecture by intent: capabilities, value streams, data and the AI layer describe what the governance, risk and compliance function does and where AI fits, which holds under whatever laws apply to you. The risk tiers, principles and controls are lasting practices for your compliance team to map to the jurisdictions you operate in.

What happens when the 180 days end?

The license continues with no end date, and corrections stay free for as long as you use the files. New versions released within 180 days of purchase are free, and we email a download link for each. After that nothing renews, and new versions are offered at 25% off.

Can I move from the Capability Model to the full blueprint?

Yes. If you upgrade within 90 days, the full price paid for the Capability Model is credited. Email your order number to support@finantrix.com for a one-time checkout code.

Could an AI assistant write this instead?

An AI assistant can describe what risk, compliance and audit teams do, and for a quick orientation that is enough. It gives a different answer each time, checks nothing against anything, and tends to describe the rules of one place instead of the work. Oversight teams answer to a board, to internal audit and to outside reviewers, so they need a fixed reference: 227 L3 capabilities with stable IDs, links validated before release, a rated AI profile with a target mode, an oversight level and a risk tier for each of the 48 L2 capabilities, and a prioritization model weighted by your own team.