A holding company may have a single information security policy, but different IT systems, contractors and managers in each legal entity. Therefore, a GRC platform in Kazakhstan should help the head office maintain an overall view, while enabling branches to take responsibility for their own risks and the implementation of controls. When choosing a platform, it is more important to test this model in practice than to compare the number of modules listed in vendors’ presentations.
Start with the Group Structure and Responsibilities
Before arranging product demonstrations, define which companies and branches will be included in the system, who approves the risk assessment methodology, who accepts residual risk and who provides evidence. The roles of the corporate CISO, local risk owner, control operator and internal auditor should also be defined separately.
Ask the vendor to demonstrate, using test data, whether a branch employee can see only their own tasks and documents, while the central team can access a consolidated view. Also test the reverse scenario: a corporate control is assigned to all companies, but one of them applies it with an agreed exception. This will show whether the product supports the organisation’s actual responsibility structure.
Review the Risk Catalogue and Control Reuse
To manage risks and controls effectively, a group of companies needs common definitions alongside local assessments. For example, the risk of account compromise may be defined consistently across the holding company, while its likelihood, impact and owner may differ between a manufacturing plant, a trading company and a service division.
The same applies to controls. A corporate access control policy can be defined once and linked to several organisations. At the same time, the performance of access rights reviews and the supporting records should remain linked to the specific branch. During the demonstration, check whether these relationships are preserved when a shared control is changed and whether it is possible to see where the new version has not yet been implemented.
If ISO 27001 automation is planned, check how the system links risks, treatment measures, responsible persons, evidence and review results. The approach to an information security management system can be compared with our company System Management’s service on ISO/IEC 27001:2022 available on the website System Management.
Assess Evidence, Exceptions and the Audit Trail
Convenient file uploading alone does not solve the audit challenge. For each piece of evidence, the relevant period, organisation, control, source, responsible person and review result should be clear. It is also useful to check whether the system sends reminders about overdue evidence and allows an auditor to trace a reported metric back to the original record.
A separate test should cover exceptions to the rule. During the pilot, create a request from a branch: specify the reason, compensating measure, owner, validity period and the person accepting the risk. Then change the decision and check whether the approval history has been preserved. A reliable audit trail should show who created, modified, approved or closed a record, and when.
Align Reporting with Management Decisions
A consolidated report is useful if it allows users to drill down into the details. Ask for a group-level summary and then drill down from the metric to the legal entity, risk, control and supporting evidence. Check not only the number of ‘closed’ tasks, but also overdue reviews, active exceptions, risks without owners and controls without up-to-date evidence.
Agree on the counting rules in advance. If one shared control is used across five branches, the report should clearly distinguish between the control itself and the five results of its implementation. Otherwise, a favourable consolidated figure may conceal a problem in one business unit.
How to Run a Pilot and Create a Shortlist
Select two different business units, 10–15 risks and several shared controls. Run the full cycle: assign owners, collect evidence, approve an exception, modify a control and prepare a report. Assess each platform using the same scenarios: access segregation, usability for local teams, traceability of changes, data export and the effort required for ongoing administration.
For an initial list of solutions, you can use the GRCfit catalogue and GRC platform matrixand then verify the stated capabilities during the pilot. GRCfit describes itself as a platform comparison service and notes that information about features should be verified with the vendors.
If the underlying processes have not yet been documented, an readiness assessment in baltum.ai ISO/IEC 27001 can help identify gaps before requirements are defined. It is a self-assessment tool, not a replacement for an independent audit or a GRC platform.
For a group that also operates in Uzbekistan, Georgia or Kyrgyzstan, include local roles, document languages, data access rules and data retention requirements in the pilot. The final choice should answer a simple question: can management trust the consolidated report, and can each branch provide evidence of the actions behind it.