Use Case · Integrated Assurance

Controls that are proven to work, not just documented.

XGRC® is internal controls software that lets organisations design, implement, test, and assure controls in a structured way. Every control is linked to the risk it mitigates and the assurance provider testing it, so control effectiveness is demonstrable at any time.

Book a demo
Integrated Assurance dashboard on the XGRC® platform
The problem

Untested controls create false assurance.

A control that exists on paper but has never been tested gives management false confidence. Weaknesses stay hidden until an audit, incident, or loss exposes them.

  1. Controls documented in policy but never tested in practice

  2. No clear owner accountable for whether a control is working

  3. Control deficiencies identified but not tracked to remediation

  4. Internal audit, risk, and compliance test the same controls independently

The XGRC® approach

A structured, testable control environment.

  1. 01

    Define the control framework and map controls to risks

  2. 02

    Assign a named owner accountable for each control

  3. 03

    Test control design and operating effectiveness on a set schedule

  4. 04

    Classify and track deficiencies through to remediation

  5. 05

    Align control testing with combined assurance coverage

  6. 06

    Report control effectiveness to management and the audit committee

How it works

Built for control owners. Visible to assurance functions.

  • Central control register linked to the risk register
  • Configurable testing schedules by risk rating
  • Structured deficiency classification and remediation tracking
  • Combined assurance mapping to avoid duplicated testing
  • Real-time dashboards on control status and test results
Integrated Assurance

One connected view of control assurance

XGRC® links every control to the risk it addresses, the tests performed against it, and the assurance provider responsible for that testing. Deficiencies are tracked to verified remediation, not just logged and forgotten.

From manual to XGRC®

The same control environment, without the blind spots.

Manual approach: Controls documented but rarely tested

XGRC® approach: Controls mapped to risks with named owners

Manual approach: No clear control ownership

XGRC® approach: Scheduled design and operating effectiveness testing

Manual approach: Deficiencies tracked in spreadsheets or not at all

XGRC® approach: Deficiencies tracked to verified closure

Manual approach: Duplicated testing across functions

XGRC® approach: Combined assurance mapping eliminates duplication

Free resource

Internal Controls Checklist

  • Control framework and design
  • Control implementation
  • Control testing
  • Deficiency management
  • Combined assurance alignment
  • Monitoring and reporting
PDF · COSO-aligned · v1.0
Standards and frameworks

Assure controls against the frameworks that matter.

  • COSO
  • ISO 31000
  • King V
  • Combined Assurance
  • Internal Audit
  • Control Assurance
Scope of application

One platform across every control type.

  • Financial and operational controls
  • IT and information security controls
  • Compliance controls
  • Combined assurance testing
Related

Explore the connected platform.

Solution

Integrated Assurance

Internal Audit & Combined Assurance

Explore Integrated Assurance → Use Case

Integrated Assurance

XGRC® coordinates internal audit and combined assurance across your organisation, linking every finding to the risk it relates to and the controls meant to manage it. Every line of defence works from the same assurance map.

View use case → Use Case

Internal Audit

XGRC® is internal audit software that lets organisations plan, execute and manage audits in a structured, consistent way. It connects audits to risks, controls and actions on a single platform, giving full visibility across the audit lifecycle.

View use case → Use Case

Risk Management

XGRC® is risk management software that lets organisations identify, assess and manage risks in a structured, consistent way. It connects risks to controls, actions and assurance activities on a single platform, giving clear visibility of risk exposure across the organisation.

View use case → Use Case

AI Governance Readiness

Two laws now sit behind AI governance: ISO/IEC 42001 certifies your organisation's AI management system, and the EU AI Act regulates each AI system individually. This checklist covers what both actually require, so a readiness gap is something you find on your own terms, not an auditor's.

View use case →
Frequently asked

Common questions.

01What is internal controls software?

Internal controls software lets organisations design, test and assure controls in a structured way, linking each control to the risk it mitigates so effectiveness can be demonstrated rather than assumed from documentation alone.

02Does XGRC® test whether controls actually work, not just whether they exist?

Yes. Controls are tested for design and operating effectiveness on a set schedule, with deficiencies classified and tracked through to verified remediation rather than logged and forgotten.

03How does this avoid duplicated control testing across teams?

Combined assurance mapping shows which assurance provider is already testing a given control, so internal audit, risk and compliance are not independently re-testing the same control.

04Which frameworks does internal controls management align to?

Internal controls align to COSO, ISO 31000 and King V, and connect directly to combined assurance and internal audit elsewhere on the platform.

See internal controls as a tested, assured process.

Book a demo to see how XGRC® turns control design, testing, and remediation into one connected, auditable workflow.

Book a demo