Governance, Risk and Compliance Capability Model: AI-Ready Edition

This GRC capability model is for CIOs, architects and transformation leads deciding where AI can help the functions that oversee the enterprise without weakening the oversight itself. It describes governance, risk, compliance, control, audit, legal, privacy, conduct, third-party risk and resilience as 48 L2 capabilities, and records for each one where AI fits, in what mode, under what human oversight and at what risk. A scoring model ranks them on your weights, and a 40-question readiness assessment shows what would hold the first uses back.

About the Governance, Risk and Compliance Capability Model

Governance, risk and compliance is usually several functions that report to different executives and describe their work in different terms. This model puts them in one structure of 10 L1 areas, 48 L2 capabilities and 227 L3 capabilities, with definitions to L3 and 197 KPIs at L2. It is a new model rather than a rebuild of an earlier map, and it covers corporate governance support, enterprise risk, compliance, internal control, internal audit, legal services, privacy, ethics and conduct, third-party risk and operational resilience.

The capabilities describe what these functions do, not the requirements they answer to. That is deliberate. Obligations differ by jurisdiction and change often; the work of identifying an obligation, mapping it to controls, testing those controls and reporting on them does not. Your compliance team maps the capabilities to the requirements that apply where you operate.

Each L2 capability has an AI profile setting out the AI opportunity, what stays human, the agents, data, AI measures, prerequisites, risks and workforce impact, with a target AI mode, an oversight level and a risk tier, and each L3 has its own ratings. In the sample, compliance obligations management (GR-3.1) is rated Augment with a human in the loop and a Moderate risk tier: an assistant drafts the obligations in a new requirement, each with the passage it comes from, and a named lead approves every change to the obligations inventory.

Why It Matters

Oversight functions often run on documents, spreadsheets and the memory of experienced staff. Risk, compliance, control and audit each keep their own inventories and their own language for overlapping work, so the same control can be described three ways and tested twice. Without a shared map it is hard to see duplication, hard to compare investment cases, and hard to explain to a board what each function is for.

AI sharpens the problem. Much oversight work is reading, comparing and drafting, which suits AI well, and the conclusions it supports are ones the organization must be able to defend. If each team adopts AI tools on its own, the enterprise ends up with judgment calls delegated inconsistently in exactly the functions meant to check judgment. The AI profiles set out, per capability, what an assistant may prepare and which decisions stay with a named person.

What's Inside

• 10 L1, 48 L2 and 227 L3 governance, risk and compliance capabilities, with definitions to L3 and 197 KPIs at L2
• A full AI profile for every L2 capability: opportunities, what stays human, agents, data, KPIs, AI measures, prerequisites, risks and workforce impact
• AI ratings for every L3: work pattern, target AI mode, AI fit and risk tier
• A prioritization model with a risk-adjusted score and rank for every L2 capability, using your own ratings and weights
• An AI heatmap of the whole model
• A 40-question weighted AI readiness assessment
• A Welcome document, the capability map deck, standalone capability definitions and KPIs documents, the Excel workbook, the user guide
• Bonus files: a governance, risk and compliance glossary, A Practical Guide to Business Architecture, a capability modeling overview, an AI-ready capability profile template and capability relationship mapping templates
• Free corrections, and new versions free for 180 days

Every file names your organization and carries your license ID. Ratings describe a typical large enterprise and are a starting point for your own.

Where It Is Used

AI opportunity assessment across oversight functions. Rate and rank the 48 L2 capabilities to find where AI can take on reading, mapping and drafting work with acceptable risk. The heatmap puts risk, compliance, audit and legal on one page for the leaders who share the budget.

Removing duplicated oversight work. Map each team's activities to the capabilities to see where risk, compliance, control and audit do the same work in different ways. A shared capability is a candidate for a shared process and a shared record.

GRC tool evaluation by capability. List the capabilities a GRC tool must support and the KPIs it should move before asking vendors to respond. Products are then compared on the work they cover, not on module names.

Designing an integrated oversight model. Use the model as the reference for combining or coordinating the oversight functions, and assign a single owner to each L2 capability so overlaps are resolved deliberately.

Readiness baseline. Run the readiness assessment with risk, compliance, audit and legal leaders to find the gaps in data, skills and governance that would hold back AI in these functions.

Integrating oversight after an acquisition. Map both organizations' oversight work to the same capabilities to see where coverage overlaps, where one is thin, and which obligations inventories and control sets must be merged first.

Who Works With It

Chief Risk Officer and Chief Compliance Officer. Describe their functions and investments in shared capability terms and decide where AI can help first.

Head of internal audit. Uses the model to plan coverage by capability and to review how AI is used in the functions audit assures.

General Counsel and legal operations. Find the legal services capabilities and confirm which interpretations and decisions stay with lawyers.

Enterprise and business architects. Link the oversight capabilities to the rest of the enterprise model and keep IDs stable across roadmaps and investment cases.

GRC transformation leads. Use the ranking and the profiles to build a program that adds AI without blurring who is accountable.

A Blank Slate, Consultants, or a Reference Model

A capability model that spans several oversight functions is harder to produce than one for a single team, because each function arrives with its own vocabulary and its own view of where its work ends.

• Building it from a blank slate. Architects run separate workshops with risk, compliance, control, audit, legal and privacy teams, reconcile overlapping definitions, and take the draft through review cycles until all of them accept it. Rating every capability for AI and building a scoring model follows after that.
• Hiring consultants to build it. Consultants bring a method and some neutrality between functions, which helps, but they still have to elicit the generic structure before tailoring it, and the model needs an owner after they leave.
• Starting from this model. The functions start from one defined structure with KPIs, AI profiles, ratings, a scoring model and a readiness assessment, already cross-checked. Workshops settle where your organization draws its lines rather than what the words mean.

Experienced advisors are most useful on the questions only your organization can answer: how the oversight functions divide responsibility, which obligations apply, and how the ratings change given the risks you actually carry. The package ratings describe a typical large enterprise.

First Steps

1. Read the Welcome document and the user guide, and share the capability map deck with the heads of each oversight function.
2. Mark which function owns each L2 capability today, and where more than one claims it.
3. Adjust the AI ratings and risk tiers in the workbook and set your weights.
4. Run the readiness assessment across risk, compliance, audit and legal.
5. Turn the top-ranked capabilities into proposals with an owner, an oversight level and KPIs.

Read the Public Sample

The sample follows one thread through the package, compliance obligations management, and is 0.78% of the content. From the Compliance Obligations Management (GR-3.1) AI profile:

• Work patterns: Knowledge retrieval, Analysis & insight, Judgment-based decision
• Target AI mode: Augment
• Human oversight: Human-in-the-loop
• AI fit / Value / Feasibility / Data readiness: 4 / 4 / 3 / 2 (1–5)
• Risk tier: Moderate
• Roadmap wave: Wave 1
• AI opportunity: Read a newly identified requirement and draft its obligations in business language, each with the passage it comes from, for the Regulatory Change Lead to add to the inventory
• What stays human: The Regulatory Change Lead approves each obligations inventory change (an obligation added, changed or retired, with where it applies) on the Obligation Mapping Assistant's draft, after hearing the Legal Reviewer and the Compliance Manager; what a requirement means in law is Legal Counsel's

Upgrade Credit

Start here and move up later: the full price of this edition counts toward the AI Transformation Blueprint for Governance, Risk and Compliance if you upgrade within 90 days. Email support@ciopages.com with your order number for a one-time checkout code.

Frequently Asked Questions

What is the difference between the two editions?

The AI-Ready Capability Model covers the capability map, an AI profile for every L2 capability, prioritization, the heatmap and the readiness assessment. The AI Transformation Blueprint adds value streams redesigned for AI, the business data model, agent specifications, use cases, responsible AI principles and controls, the operating model and the roadmap, a leadership presentation template, and bonus files on roles, operating model archetypes and transformation.

Can I upgrade from the Capability Model to the Blueprint later?

Yes. The full price you paid for the Capability Model counts toward the Blueprint if you upgrade within 90 days. Email support@ciopages.com with your order number for a one-time checkout code.

What happens after 180 days?

Your license to use the files does not end. Corrections are free for as long as you use the files. New versions released within 180 days of purchase are free: we email you a new download link when one is released. There is no renewal after that: you can buy a new version at 25% off its price.

Can I load the content into our own AI tools?

Yes, within the license. The Enterprise license allows internal tools, including your own assistants and agents. Neither license allows training, fine-tuning or prompting AI systems for third parties.

Does the package cover AI laws and regulations?

No, by design. It is business architecture: capabilities, value streams, data and the AI layer describe what the governance, risk and compliance function does and how AI fits, and they hold whichever laws apply where you operate. The risk tiers, principles and controls are durable practices your compliance team maps to your own jurisdictions.

Why not just ask ChatGPT or another AI assistant?

An AI assistant can outline what governance, risk and compliance functions do, and that outline is a fair place to begin. It changes between runs and has no checked structure, and it tends to answer in terms of specific rules rather than the work, which ties it to one jurisdiction and one moment. Oversight functions need a record that stands up to review by the board, by internal audit and by outside reviewers: stable IDs for 227 L3 capabilities, cross-references checked before release, an AI profile with a target mode and oversight level for every L2, a risk tier for each, and a scoring model you weight yourself. Use the assistant to explore; decide against the model.