Select a GRC tool: Governance, risk and compliance without filing cabinet romance

Since the NIS 2 Directive (Art. 21 NIS2-RL) and ISO/IEC 27001:2022, a GRC tool, i.e. software for governance, risk and compliance, is no longer a convenience purchase, but rather basic operational equipment. Anyone who has to document 93 controls according to ISO/IEC 27001:2022, evaluate risks according to Art. 32 GDPR and at the same time fulfil the reporting obligations under Section 130 OWiG will not be able to get through a serious audit with Excel folders. The supervisory authorities expect traceable chains of control, dated evidence and reproducible risk analyses. The approximately 29,500 companies in Germany affected by NIS 2 are faced with a double requirement: They must fulfil obligations and at the same time prove that they are fulfilling them.

This article explains which functions a reliable GRC tool must cover in 2026, which selection errors regularly occur and how the software fits into an existing representative organisation. You will receive a procurement checklist, an overview of typical integration points, an evaluation of common pricing models, and a suggestion on how to combine the licence model and Officer-as-a-Service. The goal is compliance that can be verified when the auditor calls, not just one that looks good on slides. The article primarily addresses management, compliance and IT security managers in medium-sized companies and corporations with distributed locations.

The term GRC covers three disciplines: governance, i.e. the management of responsibilities and reporting lines, risk management according to Art. 32 GDPR and ISO/IEC 27005, and compliance, i.e. compliance with legal and contractual obligations. A GRC tool integrates these three levels into a common data model. Risks are linked to controls, controls to obligations, obligations to evidence and evidence to responsible persons. This chaining is the actual value. Without it, you have four Excel tables with different versions and a high risk of producing contradictory statements in the audit.

Operationally, this means: If a new NIS 2 requirement comes into force, such as the 24-hour early warning requirement from Section 32 BSIG, the tool must be able to record this requirement, assign it to a role, link it to the appropriate controls and trigger a task to the information security officer. When a risk is updated, the system must automatically check whether the assigned controls are still appropriate and whether the associated evidence is still current. Anyone who works as an information security officer knows the consequences of poor data models: duplicate maintenance, contradictory statements, lack of evidence in the audit, high maintenance costs per quarter, and in the worst case, personal liability of the management according to Section 130 OWiG.

CIVAC implements this chain as a core function of the compliance platform and officer-as-a-service, not as an afterthought Add-on. Obligations, roles and evidence grow from a common data model that is designed for audit suitability from the start. This saves maintenance, closes gaps and reduces the friction between the department, legal department and IT to an operationally acceptable level. The assignees see their tasks in a single interface instead of in five parallel tools.

A GRC tool without a risk register is not a GRC tool. The register must assess risks according to the probability of occurrence and the extent of damage, document measures to deal with risks and show the residual risk progression over time. ISO/IEC 27005 specifies the methodological framework for information security risks, the GDPR supplements it with the data protection impact assessment according to Art. 35. Both methodologies must be mapped, ideally in parallel and with common master data on assets, processing activities and threats, so that the same threat is not assessed twice. Anyone who keeps three registers in parallel uses up man-hours that are missing from operational risk management.

The second mandatory function is control management. The 93 controls from ISO/IEC 27001:2022 Annex A must be completely stored, as well as the associated maturity levels according to a clearly defined model. Every control needs an owner, a check interval and a link to concrete evidence. Thirdly, you need an obligation database that maps laws, standards, contractual requirements and internal policies, with an update mechanism in the event of changes to the law. Fourth, audit-proof document management with versioning, release workflows and retention periods in accordance with Section 257 of the German Commercial Code (HGB) and Section 147 of the AO. Fifthly, an audit module that carries out supplier and internal audits including findings, measures and escalation paths.

If you save here, you are making false savings. The 490 ready-to-use audit templates of the CIVAC platform cover these five areas in a standardised manner, from risk assessment to supplier verification to the appointment certificate, signed, filed, verifiable. This typically saves six to twelve weeks of internal concept work during the introduction and reduces the need for advice on the methodology by a comparable amount. If you want to build your own methodology, you can, but you won't gain anything operationally because the ISO world and the German supervisory authorities expect standardised structures anyway.

The most common mistake when selecting GRC tools is focusing on feature lists instead of use cases. Providers advertise hundreds of functions, 80 percent of which you never use. What is important is not the scope, but rather how quickly your representatives can map a specific scenario. Before each demo, define three use cases from your everyday life, such as the addition of a new supplier with LkSG risk analysis, the reaction to a data protection incident with an obligation to report in accordance with Art. 33 GDPR within 72 hours and the quarterly report to the management. Run this through in the tool, not in the slide demo, with real data from your duties.

Second mistake: underestimating the data import. Existing risks, contracts, processing activities and audit findings need to be migrated, often from heterogeneous sources such as Excel, SharePoint and old GRC versions. Providers who only offer CSV uploads shift the effort to you. Third error: Hosting outside the EU. With the abolition of the Privacy Shield and the continued uncertain legal situation surrounding US cloud providers, EU data residency is non-negotiable, especially not for companies under NIS-2 or with processing of special categories of personal data in accordance with Art. 9 GDPR.

Fourth mistake: no separation of roles. Anyone who combines data protection officers, compliance officers and ISB in the same client violates the separation requirement and produces audit findings. A robust tool keeps clients and roles clearly separated, with individual reporting lines and confidentiality levels. Fifth mistake: neglecting scaling. What works with 50 risks can become unusable with 500 risks. Test search, filter and export with production-level data, ideally with anonymized data from your largest location. Anyone who renegotiates here will pay twice later, and in case of doubt the trust of the supervisory authorities.

A GRC tool is not an end in itself, but a tool for your representatives. It must align with reporting lines, not the other way around. Before the introduction, clarify: Which representatives are appointed by law, standard or contract? These are usually data protection officers (Art. 37 GDPR), information security officers (NIS-2, § 38 BSIG), compliance officers (§ 91 para. 2 AktG), money laundering officers (§ 7 GwG), whistleblower protection reporting centre (§ 14 HinSchG), supply chain officers (§ 4 LkSG) and, depending on the industry, others such as hygiene, fire protection, Hazardous substances, dangerous goods, environmental or quality management officer. In total, there are more than 20 legally or normatively defined representative roles active in Germany.

Each representative has their own duties, their own deadlines and their own report recipients. A good GRC tool maps these roles as their own views, with their own dashboards, their own task lists and their own escalation paths. The Compliance Officer sees different obligations than the ISB, but both access the common data base, such as the asset inventory, the supplier directory or the processing directory in accordance with Art. 30 GDPR. This creates a unified truth without sacrificing the separation of responsibilities and without having to maintain the same information three times.

If you don't already have a complete assignee organisation, you need to build it in parallel with the tool rollout. CIVAC combines both steps in one program. Licence the workspace for your internal representatives, or have our representatives appoint one if there is no capacity internally. Both models use the same data model, templates and audit trails. This means there is no gap between the software and the responsible person, and switching between models is possible at any time without data migration. Mixed forms, such as internal DSB and external ISB, can also be clearly represented in the platform.

A modern GRC tool is not an isolated system. It must communicate with your home's leading systems. At least five interfaces are mandatory. First, identity management, such as Entra ID or Okta, for role-based permissions and single sign-on, ideally with SCIM provisioning. Secondly, asset management or the CMDB, so that risks and controls are linked to specific systems. Thirdly, the ticket system, such as Jira Service Management or ServiceNow, so that measures flow directly into operations and are not lost in a separate GRC workflow. Fourth, document management so that contracts and policies are not maintained twice. Fifth, the reporting path to authorities, in particular the NIS-2 24/72 reporting path to the BSI.

In addition, API-based data queries are becoming increasingly important. Auditors increasingly expect evidence to be drawn not from PDFs but from live systems, such as configuration states of firewalls, patch levels of servers, backup success rates or logging completeness. The GRC tool thus becomes the central bridge between technical systems and auditable documentation. Without this bridge, every audit preparation remains manual, detailed work, with a high potential for errors and unclear deadline logic. Whoever builds the bridge gains continuous audit capability instead of an annual special project, thereby significantly relieving the burden on those responsible in the hot audit phase.

CIVAC operates these interfaces with ISO/IEC 27001:2022 ISMS and EU data residency, so that even corporations with strict data classification can use the platform for reporting obligations to supervisory authorities, auditors and suppliers. Anyone who does not check this risks audit findings in the subprocessor area, with all the consequences for contracts, insurance and credit ratings. The interfaces are implemented as REST APIs with OAuth2 authentication and are fully documented, so that even IT architects without prior CIVAC knowledge can control the integration. Audit-proof, documented, § 130-OWiG-proof.

GRC tools are usually offered per user per month or as an enterprise licence. The range is considerable: from around 30 euros per user per month for lean solutions to several hundred thousand euros in annual fees for corporate suites with an unlimited number of users. However, the pure licence fee is rarely the largest item. The total cost of ownership includes implementation services, data migration, training, annual maintenance fees and most importantly the internal man-hours for maintenance and data quality. Rule of thumb: Allow three times the licence fee in the first year and double in subsequent years.

Pay attention to four points in the contract. Firstly, the right to return data at the end of the contract: your data must be delivered in a machine-readable format, without an additional fee and with a clearly defined deadline. Secondly, the subprocessor list: If the provider uses US subprocessors, for example for hosting, telemetry or support, there is a risk of a GDPR conflict that cannot be resolved through standard contractual clauses alone. Third, the SLA for availability and recovery time. With a GRC tool that maintains evidence for audits, a failure during the audit week is painful and can produce findings. Fourth, the price adjustment clause: Uncapped indexing leads to significant cost increases over three years that were not planned for in the procurement process.

CIVAC offers an SLA of two working days for the appointment of external representatives, instead of the industry standard two to six weeks. This is the real lever for many companies, because otherwise the tool introduction fails due to a lack of responsible people. The licence and mandate can be terminated separately so that there is no lock-in. A change from external to internal staffing is also possible without data migration because the data model remains constant.

The most important question for any GRC tool is: How well does it stand up to an external audit? Not in theory, but when the auditor sends you a list of 40 samples three weeks before the start of the audit. What is reliable is a tool that can display evidence of each of these samples within minutes, including the version status, person responsible and release date. Anyone who has to browse here has the wrong tool or the wrong data model, often both in combination, and produces exactly the findings that a well-run GRC tool is actually supposed to prevent.

Three indicators are crucial. Firstly, the full-text search for all documents, measures, risks and obligations, with filtering by status, retention period and release status. Secondly, filtering by audit scope, such as location, business area, processing activity or ISO application area. Thirdly, the possibility of granting read audit access to external auditors, with access to the defined scope and audit-proof logging of access. Anyone who gives an examiner full admin access no longer has any protection against cross-viewing areas that are not relevant to the examination and risks unintentional disclosures.

The auditor calls, the evidence is ready. This is how it has to work, at the location, in the group audit and in the regulatory audit according to NIS-2, ISO 27001 or GDPR. At the CIVAC FAQ you will find concrete answers to testing and ordering processes, including client separation for external auditors and group audits. Deadline begins as soon as we become aware of it. Those who internalize this build audit preparation as a permanent situation, not as a special project, and noticeably reduce the annual audit effort, often in the range of 30 to 50 percent of the previous man-hours.

A GRC tool introduction rarely fails due to technology, almost always due to unclear responsibilities and unstructured legacy data. A realistic timetable takes eight to twelve weeks until the first productive use, and another three to six months until the complete migration. Week one and two: Scope definition, definition of clients and roles, selection of the first three use cases, clarification of reporting lines to management and the supervisory board. Week three and four: data migration of the existing risks and obligations, creation of the 93 ISO controls, linking to assets and processing activities, cleaning up of duplicates and outdated entries.

Week five and six: training of the representatives in a dedicated workshop, definition of the escalation paths, connection of the interfaces to IDM, CMDB and ticket system. Week seven and eight: Pilot operation with real incidents and a test audit, fine-tuning of the workflows, transfer to regular operation, establishment of the monthly control jour-fixe. The critical success factor is an internal project manager with a clear mandate from management. Without this sponsor, tool introductions become bogged down in detailed discussions about field labels and maturity models.

If a mandate is not available internally, an external representative with implementation experience can take on the role, for example as external compliance officer with a dual function in the platform introduction. This means there is no gap between procurement and productive use. The first three use cases can usually be audited after week six, the complete scope after quarter two. The CIVAC SLA of two working days for the appointment of external representatives has a double effect here: faster tool introduction and at the same time formal legal certainty vis-à-vis the supervisory authority, because the appointment certificate is dated and fileable from the start and can be presented at any time during the audit.

A GRC tool is a prerequisite, but not a replacement for a functioning representative organisation. The software documents what people decide. If the roles are not filled, if reporting lines are missing, or if management is not actively using the system, the tool remains an expensive database. The effective combination is always both: a platform that reliably records obligations, risks and evidence, plus representatives who work with the platform and report to management. This combination is what counts in an audit, and it is also what counts in the liability discussion after an incident.

CIVAC, as a compliance platform and officer-as-a-service, is built precisely for this combination. Licence the workspace for your internal representatives, or have our representatives appoint one if there is no capacity internally. Both paths lead to the same result: a compliance organisation that can be verified when the auditor calls. Others run compliance like a filing cabinet. We run it like software. The data model, the 490 audit templates and the 93 ISO controls are independent of the selected model.

Turn reading into a mandate. Write to info@civac.de or use the contact form on civac.de to arrange a platform demo or an initial meeting to appoint external representatives. You will receive feedback within two working days, including a suggestion for the appropriate licence or mandate model and an indication of the implementation effort and timeline. If you wish, we will send you an anonymized example of the workspace structure in advance so that you can get a concrete impression of the data model, the 490 templates and the reporting lines before the appointment. Initial discussions are usually conducted by one of our authorised officers, so that both technical and operational questions can be answered directly. The appointment certificate, signed, filed, verifiable.