Governance, Risk and Compliance Business Data Model: AI-Ready Edition

The Governance, Risk and Compliance Business Data Model: AI-Ready Edition is for CIOs, architects and transformation leads who need to know what information governance, risk and compliance work runs on before an AI agent touches it. It covers 16 subject areas, 115 entities, 838 key attributes and 377 relationships. Every entity and key attribute is classified for sensitivity, with the AI uses and data-quality requirements an agent depends on. It is the data-model part of Business Architecture for Governance, Risk and Compliance: AI Transformation Blueprint, sold on its own.

What's Inside

The same model comes in three files: the full model in Word, a workbook to filter and extend, and a guide to the scales and the license.

• 16 subject areas and 115 entities, each with a definition, its typical system of record, sensitivity class, AI uses and data-quality requirements
• 838 key attributes with sensitivity and AI relevance, and 377 relationships with cardinality
• Under each entity, the capabilities that need it and the agents that read it, by name and ID
• The Business Data Model (Word): every subject area and entity in full
• The workbook (Excel): subject areas, entities, attributes and relationships in sheets you can filter and extend
• The guide (Word): the scales the model refers to, the data foundation, and the license
• Free corrections, and new versions free for 180 days

Every file names your organization and carries your license ID.

The 16 Subject Areas

The 115 entities are grouped into 16 subject areas. The list gives what each holds and how many entities it has.

• Board, Entities & Delegated Authority (7 entities): How the organization is directed and who may decide what: board and governance body meetings, their papers and recorded decisions, delegated authority, and the legal entities with their statutory filings.
• Policies & Exceptions (4 entities): The enterprise policy library and its use: each policy, its approved versions, the exceptions granted against it and the acknowledgments people give.
• Risk Framework & Appetite (5 entities): The frame every risk decision works within: the risk categories, the risk appetite statements and the limits that make them measurable, the authority levels that say who may accept which risk, and the assessments of risk culture.
• Enterprise Risks & Risk Decisions (6 entities): The enterprise risk register and the decisions taken on it: each risk, its assessments, self-assessments by the business, risks submitted by specialist functions, treatment plans and risk acceptances.
• Risk Monitoring, Events & Scenarios (6 entities): How risk is watched over time: key risk indicators and their readings, breaches of appetite, risk events and losses, emerging risks and scenario analyses.
• Obligations & Requirement Change (7 entities): What the organization must do and how that changes: the applicable requirements, the obligations derived from them and where each applies, retention requirements, and requirement changes with their impact assessments and plans.
• Compliance Monitoring, Breaches & Attestation (6 entities): How compliance is checked and reported: the compliance plan, monitoring activities, compliance tests, suspected breaches, breach determinations and attestations.
• Supervisory Authority Engagement (5 entities): The organization's dealings with supervisory authorities: the authorities it deals with, their inquiries, the submissions it must make, the commitments it gives and its decisions on voluntary disclosure.
• Controls, Testing & Issues (9 entities): Internal control from design to remediation: the processes controls sit in, the controls, self-assessments, segregation of duties conflicts, control tests and evidence, deficiencies, issues and the actions that close them.
• Internal Audit (9 entities): Internal audit, independent of management: the audit universe, the audit plan, engagements, work records, audit evidence, findings, reports, the overall opinion and quality reviews.
• Legal Matters, Advice & Contracts (10 entities): The legal function's work: requests for legal help, legal matters, legal advice and positions, legal holds, matter documents, outside counsel, standard contract terms, contract reviews and corporate transactions.
• Privacy (9 entities): The privacy program: the record of processing activities, privacy notices, privacy impact reviews, high-risk processing decisions, transfer safeguard assessments, personal data requests, privacy incidents, harm assessments and notification decisions.
• Ethics, Speak-Up & Investigations (10 entities): Ethics and integrity: conduct standards, speak-up reports, reporter protection, investigations with their evidence, findings and referrals, conflict of interest declarations, gifts, hospitality and donations, and restricted party screening.
• Third Parties (6 entities): Third parties as sources of risk: each third party, the relationships the organization has with it, due diligence assessments, third-party risk decisions, exceptions to the method and exit plans.
• Resilience, Continuity & Crisis (9 entities): Keeping critical business services running: the services, their dependencies, business impact analyses, recovery requirements, continuity plans, exercises, crisis records, crisis decisions and crisis communications.
• AI & Digital Labor Governance (7 entities): The governance of AI in governance, risk and compliance: AI systems and agents, agent action logs, records of AI-assisted decisions, model validations, human reviews and each agent's authority limits.

Who Uses It

Data owners and stewards, data architects, and AI and analytics engineers who need to know what an agent may read, how sensitive it is and how good it must be first; and business architects who link capabilities to data.

How It Fits With the Other Products

The capabilities named under each entity are defined in the Governance, Risk and Compliance Capability Model: AI-Ready Edition. The agents are specified in Business Architecture for Governance, Risk and Compliance: AI Transformation Blueprint, which contains this data model and adds the value streams, use cases, controls, an operating model and a roadmap. The Governance, Risk and Compliance Value Streams are sold on their own too.