Governance, Risk and Compliance Value Streams: AI-Ready Edition

The Governance, Risk and Compliance Value Streams: AI-Ready Edition is for CIOs, architects and transformation leads who need to see how governance, risk and compliance work runs from trigger to value, and where AI belongs in it. It covers 12 value streams in 60 stages. Each stage is shown as it runs today and as it could run with AI, with the target AI mode, the agents involved and the human checkpoint that stays with a person. It is the value-stream part of Business Architecture for Governance, Risk and Compliance: AI Transformation Blueprint, sold on its own.

What's Inside

The same 12 value streams come in three files: a deck to present, a workbook to work in and a guide to read. The workbook holds every field; the deck shows each stage as it runs today and AI-native, with its AI mode and human checkpoint.

• 12 governance, risk and compliance value streams and their 60 stages, each with its steps, stakeholders, entry and exit criteria, and the capabilities that enable it
• For every stage: today's pain points, the AI-native future state, the agents involved, the target AI mode, the human checkpoint and KPIs
• 17 standard governance, risk and compliance value streams with their steps, as a reference process view
• The Value Streams deck (PowerPoint): every value stream as a flow, then stage by stage
• The workbook (Excel): the value streams and every stage, in sheets you can filter and extend
• The guide (Word): the scales used at each stage (AI mode, human oversight, risk tier and work pattern), every value stream in prose, and the license
• Free corrections, and new versions free for 180 days

Every file names your organization and carries your license ID.

The 12 Value Streams

Each value stream runs from a trigger to the value it delivers. The list gives that value and the number of stages.

• Business Strategy to Agreed Risk Appetite (5 stages): A risk appetite the board has approved, tied to the strategy, turned into limits that business units and decisions can use, and watched through indicators that warn before a limit is breached.
• Risk Identified to Risk Decision (5 stages): Every significant risk known, rated in one way, owned by a named Process Owner, decided at the right level of authority and treated, so risk is managed before harm rather than discovered after it.
• Regulatory Change to Compliant Operation (5 stages): Each relevant requirement change found early, assessed once with the legal function, built into the policies, processes and controls it affects, and shown to be met by the day it takes effect.
• Obligation Identified to Compliance Attested (5 stages): Each obligation owned, monitored and tested in proportion to its risk, breaches determined and fixed by the right people, and attestations and certifications backed by evidence leadership and the board can rely on.
• Control Need to Assured Control (5 stages): Controls designed in proportion to the risks and obligations they address, operated and monitored by their owners, tested by people independent of them, and fixed and verified when they fail.
• Audit Plan to Closed Findings (5 stages): Independent, objective assurance on governance, risk management and control, delivered to a risk-based plan, with findings management can act on and actions verified before they are closed.
• Concern Raised to Matter Resolved (5 stages): A safe channel that acts: every report received and recorded once, routed to the right owner, investigated fairly where it is ethics or compliance misconduct, referred to the people who decide outcomes, and closed with the reporter protected throughout.
• Legal Request to Resolved Matter (5 stages): Legal risk understood and handled at a known cost: routine requests answered from approved guidance, advice given by an accountable lawyer, positions recorded for reuse, and matters resolved within the authority of the people who decide.
• Personal Data Use Proposed to Approved Processing (5 stages): New uses of personal data launched with the people concerned informed and their interests weighed, high-risk uses decided by an accountable executive, and each use checked once it runs.
• Third-Party Need to Assured Relationship (5 stages): Third parties the organization can depend on: each relationship tiered by its inherent risk, assessed in proportion, decided at the authority level it requires, written into the contract, watched until exit and left without disruption.
• Critical Service Identified to Proven Resilience (5 stages): Critical business services that keep running or come back within the disruption each can bear, with recovery requirements, plans and a crisis team proven by exercises and tests rather than assumed.
• Disruption to Recovered Operations (5 stages): A coordinated response with decisions made by the people the crisis plan names, critical operations recovered within their requirements, clear and approved information to the people affected, and lessons applied.

Who Uses It

Process owners and the teams who redesign governance, risk and compliance work, transformation leads who need a future-state process view to plan from, and business architects who map value streams to capabilities.

How It Fits With the Other Products

Each stage names the capabilities that enable it; they are defined in the Governance, Risk and Compliance Capability Model: AI-Ready Edition. The agents each stage involves are specified in Business Architecture for Governance, Risk and Compliance: AI Transformation Blueprint, which also holds the business data model, use cases, controls, an operating model and a roadmap. The Governance, Risk and Compliance Business Data Model is sold on its own too.

Target AI modes describe a typical large enterprise and are a starting point for your own.