Evaluate IT GRC framework

We ask You to fill out the questionnaire about the presented framework's completeness. Under each Process flow, You can leave comments/feedback.

Page 1 Page 2 Page 3 Page 4

Process name	Definitely include	Maybe include	Maybe exclude	Definitely exclude
1) Performance measurement „track and monitor strategy implementation, project completion, resource usage, process performance and service delivery, using, for example balanced scorecards that translate strategy into action to achieve goals measurable beyond conventional accounting” [Krey, 2010]

Comment if some processes are missing, or there are too much of them

Process name	Definitely include	Maybe include	Maybe exclude	Definitely exclude
1) Re-assess risks overall process of risk identification, risk analysis and risk evaluation [ISO 31000:2009]
2) Evaluate heatmaps evaluating current status of the auditable subject according to reported heatmaps
3) Measure KPIs (Key Performance Indicators) – measuring organization/IT/department performance using its agreed KPIs
4) Inspect internal controls „systematic, independent and documented process for obtaining audit evidence and evaluating it objectively to determine the extent to which the audit criteria are fulfilled“ [ISO 19600:2014]

Comment if some processes are missing, or there are too much of them

Process name	Definitely include	Maybe include	Maybe exclude	Definitely exclude
1) Report findings „The governing body, management and the compliance function should ensure that they are effectively informed on the performance of the organization’s compliance management system and of its continuing adequacy, including all relevant noncompliances, in a timely manner..“ [ISO 19600:2014]
2) Escalation where appropriate

Comment if some processes are missing, or there are too much of them

Progress