Governance, Risk and Compliance Capability Model: AI-Ready Edition
A new GRC capability model of 10 L1, 48 L2 and 227 L3 capabilities, with 197 KPIs and an AI profile for every L2 capability.
About This Capability Model
Risk, compliance and audit teams at banks, insurers, asset and wealth managers and payments firms can use this governance risk and compliance capabilities map to describe their work in business terms before deciding where AI fits. The model is cross-industry and describes the functions, not any rulebook: 227 L3 capabilities across ten areas from enterprise risk to operational resilience. Each L2 capability carries an AI profile with a target AI mode, a human oversight level and a risk tier, and the prioritization model ranks them.
What it isInside the Governance, Risk and Compliance Capability Model
Governance, risk and compliance is usually several functions that report to different executives and describe their work in different terms. This model puts them in one structure of 10 L1 areas, 48 L2 capabilities and 227 L3 capabilities, with definitions to L3 and 197 KPIs at L2. It is a new model rather than a rebuild of an earlier map, and it covers corporate governance support, enterprise risk, compliance, internal control, internal audit, legal services, privacy, ethics and conduct, third-party risk and operational resilience.
The capabilities describe what these functions do, not the requirements they answer to. That is deliberate. Obligations differ by jurisdiction and change often; the work of identifying an obligation, mapping it to controls, testing those controls and reporting on them does not. Your compliance team maps the capabilities to the requirements that apply where you operate.
Each L2 capability has an AI profile setting out the AI opportunity, what stays human, the agents, data, AI measures, prerequisites, risks and workforce impact, with a target AI mode, an oversight level and a risk tier, and each L3 has its own ratings. In the sample, compliance obligations management (GR-3.1) is rated Augment with a human in the loop and a Moderate risk tier: an assistant drafts the obligations in a new requirement, each with the passage it comes from, and a named lead approves every change to the obligations inventory.
The Problem Behind It
Oversight functions often run on documents, spreadsheets and the memory of experienced staff. Risk, compliance, control and audit each keep their own inventories and their own language for overlapping work, so the same control can be described three ways and tested twice. Without a shared map it is hard to see duplication, hard to compare investment cases, and hard to explain to a board what each function is for.
AI sharpens the problem. Much oversight work is reading, comparing and drafting, which suits AI well, and the conclusions it supports are ones the organization must be able to defend. If each team adopts AI tools on its own, the enterprise ends up with judgment calls delegated inconsistently in exactly the functions meant to check judgment. The AI profiles set out, per capability, what an assistant may prepare and which decisions stay with a named person.
The deliverablesWhat's Inside
- 10 L1, 48 L2 and 227 L3 governance, risk and compliance capabilities, with definitions to L3 and 197 KPIs at L2
- A full AI profile for every L2 capability: opportunities, what stays human, agents, data, KPIs, AI measures, prerequisites, risks and workforce impact
- AI ratings for every L3: work pattern, target AI mode, AI fit and risk tier
- A prioritization model with a risk-adjusted score and rank for every L2 capability, using your own ratings and weights
- An AI heatmap of the whole model
- A 40-question weighted AI readiness assessment
- A Welcome document, the capability map deck, standalone capability definitions and KPIs documents, the Excel workbook, the user guide
- Bonus files: a governance, risk and compliance glossary, A Practical Guide to Business Architecture, a capability modeling overview, an AI-ready capability profile template and capability relationship mapping templates
- Free corrections, and new versions free for 180 days
Every file names your organization and carries your license ID. Ratings describe a typical large enterprise and are a starting point for your own.
Putting it to workUse Cases
AI opportunity assessment across oversight functions. Rate and rank the 48 L2 capabilities to find where AI can take on reading, mapping and drafting work with acceptable risk. The heatmap puts risk, compliance, audit and legal on one page for the leaders who share the budget.
Removing duplicated oversight work. Map each team's activities to the capabilities to see where risk, compliance, control and audit do the same work in different ways. A shared capability is a candidate for a shared process and a shared record.
GRC tool evaluation by capability. List the capabilities a GRC tool must support and the KPIs it should move before asking vendors to respond. Products are then compared on the work they cover, not on module names.
Designing an integrated oversight model. Use the model as the reference for combining or coordinating the oversight functions, and assign a single owner to each L2 capability so overlaps are resolved deliberately.
Readiness baseline. Run the readiness assessment with risk, compliance, audit and legal leaders to find the gaps in data, skills and governance that would hold back AI in these functions.
Integrating oversight after an acquisition. Map both organizations' oversight work to the same capabilities to see where coverage overlaps, where one is thin, and which obligations inventories and control sets must be merged first.
Who It Is For
Chief Risk Officer and Chief Compliance Officer. Describe their functions and investments in shared capability terms and decide where AI can help first.
Head of internal audit. Uses the model to plan coverage by capability and to review how AI is used in the functions audit assures.
General Counsel and legal operations. Find the legal services capabilities and confirm which interpretations and decisions stay with lawyers.
Enterprise and business architects. Link the oversight capabilities to the rest of the enterprise model and keep IDs stable across roadmaps and investment cases.
GRC transformation leads. Use the ranking and the profiles to build a program that adds AI without blurring who is accountable.
The economicsThe Alternatives
A capability model that spans several oversight functions is harder to produce than one for a single team, because each function arrives with its own vocabulary and its own view of where its work ends.
- Building it from a blank slate. Architects run separate workshops with risk, compliance, control, audit, legal and privacy teams, reconcile overlapping definitions, and take the draft through review cycles until all of them accept it. Rating every capability for AI and building a scoring model follows after that.
- Hiring consultants to build it. Consultants bring a method and some neutrality between functions, which helps, but they still have to elicit the generic structure before tailoring it, and the model needs an owner after they leave.
- Starting from this model. The functions start from one defined structure with KPIs, AI profiles, ratings, a scoring model and a readiness assessment, already cross-checked. Workshops settle where your organization draws its lines rather than what the words mean.
Experienced advisors are most useful on the questions only your organization can answer: how the oversight functions divide responsibility, which obligations apply, and how the ratings change given the risks you actually carry. The package ratings describe a typical large enterprise.
Getting Started
- Read the Welcome document and the user guide, and share the capability map deck with the heads of each oversight function.
- Mark which function owns each L2 capability today, and where more than one claims it.
- Adjust the AI ratings and risk tiers in the workbook and set your weights.
- Run the readiness assessment across risk, compliance, audit and legal.
- Turn the top-ranked capabilities into proposals with an owner, an oversight level and KPIs.
Read the Public Sample
The sample follows one thread through the package, compliance obligations management, and is 0.78% of the content. From the Compliance Obligations Management (GR-3.1) AI profile:
- Work patterns: Knowledge retrieval, Analysis & insight, Judgment-based decision
- Target AI mode: Augment
- Human oversight: Human-in-the-loop
- AI fit / Value / Feasibility / Data readiness: 4 / 4 / 3 / 2 (1–5)
- Risk tier: Moderate
- Roadmap wave: Wave 1
- AI opportunity: Read a newly identified requirement and draft its obligations in business language, each with the passage it comes from, for the Regulatory Change Lead to add to the inventory
- What stays human: The Regulatory Change Lead approves each obligations inventory change (an obligation added, changed or retired, with where it applies) on the Obligation Mapping Assistant's draft, after hearing the Legal Reviewer and the Compliance Manager; what a requirement means in law is Legal Counsel's
Upgrade Credit
Start here and move up later: the full price of this edition counts toward the AI Transformation Blueprint for Governance, Risk and Compliance if you upgrade within 90 days. Email support@finantrix.com with your order number for a one-time checkout code.
Read before you buyFrequently Asked Questions
What is the difference between the two editions?
The AI-Ready Capability Model covers the capability map, an AI profile for every L2 capability, prioritization, the heatmap and the readiness assessment. The AI Transformation Blueprint adds value streams redesigned for AI, the business data model, agent specifications, use cases, responsible AI principles and controls, the operating model and the roadmap, a leadership presentation template, and bonus files on roles, operating model archetypes and transformation.
Can I upgrade from the Capability Model to the Blueprint later?
Yes. The full price you paid for the Capability Model counts toward the Blueprint if you upgrade within 90 days. Email support@finantrix.com with your order number for a one-time checkout code.
What happens after 180 days?
Your license to use the files does not end. Corrections are free for as long as you use the files. New versions released within 180 days of purchase are free: we email you a new download link when one is released. There is no renewal after that: you can buy a new version at 25% off its price.
Can I load the content into our own AI tools?
Yes, within the license. The Enterprise license allows internal tools, including your own assistants and agents. Neither license allows training, fine-tuning or prompting AI systems for third parties.
Does the package cover AI laws and regulations?
No, by design. It is business architecture: capabilities, value streams, data and the AI layer describe what the governance, risk and compliance function does and how AI fits, and they hold whichever laws apply where you operate. The risk tiers, principles and controls are durable practices your compliance team maps to your own jurisdictions.
Why not just ask ChatGPT or another AI assistant?
An AI assistant can outline what governance, risk and compliance functions do, and that outline is a fair place to begin. It changes between runs and has no checked structure, and it tends to answer in terms of specific rules rather than the work, which ties it to one jurisdiction and one moment. Oversight functions need a record that stands up to review by the board, by internal audit and by outside reviewers: stable IDs for 227 L3 capabilities, cross-references checked before release, an AI profile with a target mode and oversight level for every L2, a risk tier for each, and a scoring model you weight yourself. Use the assistant to explore; decide against the model.
| A generic AI-generated list | This package | |
|---|---|---|
| Structure | A plausible list that changes between runs | A fixed model with stable IDs: 10 L1, 48 L2 and 227 L3 capabilities, defined to L3 |
| Cross-references | Not checked | Every link between capabilities, ratings and the readiness assessment is validated before release |
| Where AI fits | Suggestions you have to verify yourself | An AI profile for every L2 capability: AI mode, human oversight, opportunities, what stays human, data, KPIs, prerequisites and risks |
| Risk | Generic cautions | A risk tier for every L2 capability, with every capability that informs a decision about a person flagged |
| Scoring | No model to score against | A prioritization model with your own ratings and weights, and a 40-question readiness assessment |
| Durability | Shifts with each prompt and model version | Capabilities that describe what the governance, risk and compliance function does, independent of any tool, vendor or law, with free corrections and 180 days of free new versions |
What's Included
+ 1 more files included
At a Glance
- 10 L1 · 48 L2 · 227 L3 governance, risk and compliance capabilities
- Definitions to L3, KPIs at L2
- AI profile for every L2 capability
- Target AI mode, oversight and risk tier
- Prioritization with your own weights
- AI heatmap
- 40-question AI readiness assessment
- Excel, Word and PowerPoint
- New versions free for 180 days
Enterprise License
Consultancy License
All sales are final. We do not offer refunds, returns or exchanges.
Delivered instantly on payment. EU and UK consumers: starting the download ends the 14-day right of withdrawal.
Prices exclude tax. Any sales tax, VAT or GST due in your country is added at checkout.
Sign up for Finantrix Insights for periodic updates of new and notable.
Protected by reCAPTCHA. No spam. Unsubscribe anytime.
The Finantrix Store sells reusable business-architecture reference deliverables — capability models, data models, and value-stream maps — built for financial-services strategy and technology teams.
Browse the full Store →Before You Buy
The questions worth settling first. Still unsure? Email us before purchasing — sales are final.
What exactly do I receive?
The files listed under "What's Included" on the product page, and nothing beyond them. Most products are editable PowerPoint, Excel, and Word documents; some are supplied as archives containing those files. Delivery is immediate — a download link is issued as soon as payment completes.
Are the files editable, or locked?
Editable. They are working documents in their native formats, not locked PDFs or images, because the point of the product is that you customize it. A few reference guides are supplied as PDF where editing them would serve no purpose.
How long is my download link valid?
Links stay active for 7 days after purchase and allow up to 3 downloads. Save the files somewhere durable when you receive them. If a link expires or you run out of downloads, email support@finantrix.com and we will issue a new one — that is a support request, not a repurchase.
What is the difference between the Enterprise and Consultancy licenses?
An Enterprise License covers use anywhere within a single organization — your colleagues can all work from the material. A Consultancy License covers use across multiple client engagements, which the Enterprise License does not permit. If you advise more than one organization, the Consultancy License is the one you need. Full terms are at /legal/digital-products-terms.
Do I get a receipt and proof of license?
Yes, both, automatically. Your order confirmation email links to a purchase receipt and a license certificate, and normally carries them as PDF attachments as well. Unlike the download link, those documents do not expire and opening them does not use up one of your 3 downloads — they are there for expense claims, accounting, and procurement reviews that arrive long after the files do. Finantrix collects no sales tax or VAT, so the receipt shows the tax line as not applicable rather than as a computed amount.
Can I get a refund?
As a rule, no. These are digital products delivered immediately and in full, so sales are final — we do not offer returns, refunds or exchanges once a purchase completes. If you buy as a consumer in the EU or UK, you have a 14-day right of withdrawal that ends when you ask us to start the download, which is what you confirm at checkout. Where Stripe is the merchant of record for your purchase, Stripe operates its own refund process and may decide a request itself. All of this is why every product page carries a detailed manifest and an honest note on fit: we would rather you decide correctly before buying than be disappointed afterwards. If you are unsure whether a product suits your situation, email support@finantrix.com before purchasing and we will tell you.
How much customization should I expect to do?
A meaningful amount, and that is by design. These are generic, sector-level artifacts intended as a substantial head start rather than a finished deliverable for your organization. Each product page includes an honest note on fit setting out, deliverable by deliverable, what is complete and what you will need to supply.
Is implementation help or support included?
No. The purchase covers the files only — it does not include customization, implementation assistance, training, or consulting. Our consulting team is available separately on a paid basis if you want deeper help; contact us to discuss scope.
Do you offer a preview or sample before purchase?
Not as a downloadable sample. The product page is the preview: it lists every file, states the capability counts and levels of decomposition, and sets out where the artifact stops. If something specific would settle your decision, email support@finantrix.com and ask.
Can I share the files with colleagues or clients?
Colleagues within your organization, yes, under the Enterprise License. Clients, no — that requires a Consultancy License. Redistribution, resale, or publishing the material publicly is not permitted under either license.
How current is the content?
The artifacts describe business structure — capabilities, value streams, information entities — which changes far more slowly than technology or regulation. Where a product includes market-facing material such as vendor profiles, the product page says so and advises verifying currency before relying on it for a decision.
Related Frameworks
Business Architecture Packages
Business Architecture for Governance, Risk and Compliance: AI Transformation Blueprint
From $3295Business Information Model
Governance, Risk and Compliance Business Data Model: AI-Ready Edition
From $495Value Streams
Governance, Risk and Compliance Value Streams: AI-Ready Edition
From $495Capability Models