The inventory of controls with its owner, and versioned policies with staff acceptance on record. Without that, nobody knows who to ask.
ControlsPoliciesOwnersHistory
Guide · What a GRC is
Comply once and be able to prove it all year round.
A GRC is the category of software that keeps a company's governance, risk and compliance alive. Instead of assembling the evidence every time an audit arrives, it keeps it current on its own.
What this family of software does
G
Governance
Who answers for what?
R
Risk
What can go wrong and how much does it matter?
C
Compliance
Can you prove it today?
Three questions a company has to be able to answer.
Governance, risk and compliance usually live in three separate spreadsheets with three different owners. A GRC exists to make them one thing.
A register with an impact and likelihood matrix. Recording a risk does not reduce it: the treatment plan does, with an owner and a deadline.
MatrixPlansResidual riskSuppliersThe evidence that the controls work, dated and with its owner. Not the version assembled by hand the week before the audit.
EvidenceMonitoringAlertsAuditWhat turns three spreadsheets into a system is that all three work on the same inventory of controls. A control has an owner, answers to several standards, reduces a risk and produces its own evidence. If that lives in separate places, it has to be synced by hand —and nobody does that twice.
Why this category exists
The same work, four times a year.
A company does not face a single audit. It faces several, plus its customers' questionnaires, and each asks for similar proof of the same controls.
Without a GRCEvery event starts from scratchWeeks of manual work
Jan – MarApr – JunJul – SepOct – Dec
ISO 27001 auditGather evidence
A customer questionnaireAnswer by hand
Law 21,719Document it again
SOC 2 reviewHunt for the same proof
Every milestone asks again for screenshots, signed policies and access logs. They are the same controls, documented all over again.
With a GRCThe evidence never stops being currentThe whole year
Jan – MarApr – JunJul – SepOct – Dec
ISO 27001 auditAlready done
A customer questionnaireAlready done
Law 21,719Already done
SOC 2 reviewAlready done
The inventory is mapped once and the proof collects itself from the connected systems. The audit stops being a project and becomes a query.
What problems it solves
Evidence
The proof lives in screenshots and emails
Duplication
The same control gets documented three times
Sales
The security questionnaire stalls the deal
Risk
The risk was recorded, but nobody reduced it
Third parties
A critical supplier with an expired certificate
Access
Someone left and their access stayed alive
Six scenes that repeat in every company.
When the audit arrives you have to go hunting: asking each person for their screenshot, their spreadsheet, their confirmation.
A single repository where every piece of proof is dated, with its owner and its trail.Each standard is worked separately, with its own spreadsheet and folder, even though they ask for practically the same thing.
The inventory is mapped once and one control answers to every standard you have to meet.A big customer sends two hundred questions. Sales waits; someone in IT answers them between other things.
The answers come from an approved library, with a review before sending.The matrix exists and is updated once a year. In between, the risk stays exactly as high as when it was written down.
Treatment plans with an owner and a deadline, and residual risk that moves as the plan advances.Nobody checks third-party expiry dates until an auditor asks about that particular supplier.
A register assessed by criticality, with alerts for documents about to expire and a file per supplier.The departure was announced by email. Someone had to revoke access in four systems and did it in three.
The control is monitored continuously and the alert reaches the owner, not a shared inbox.
Who it helps
Security and IT
Legal and personal data
Leadership
Sales
Procurement and suppliers
Human resources
Compliance is not one department's problem.
Each area contributes a different piece of proof about the same system. That is why it works when they all work on the same inventory.
They hold up most of the technical controls: access, backups, MFA, periodic reviews.
They translate the legal obligation into concrete controls and answer when the authority asks.
They need to know, without requesting a report, how exposed the company is and what is being done about it.
No more waiting: customer security questionnaires are answered from an approved library.
Assessment by criticality, expiry dates under control and a file for every third party that touches your data.
Policy acceptance per person, current training and the employment documentation the authority may ask for.
What you have to comply with
Check the standards that apply to you.
An operator in Chile does not only meet ISO. It meets ISO, SOC 2, the personal data law, the cybersecurity framework and whatever its most demanding customer asks for.
International · what is asked of you abroad
Chile · what is already a local obligation
0standards
Check the ones that apply. The question is not how many there are: it is how many times you are going to document the same control.
Why Legale GRC
Governance
Controls and policies
Compliance
Continuous monitoring and evidence
Risk
Risk management
Third parties
Supplier risk
Trust
Trust center
Sales
Questionnaire assistant
Six modules over a single inventory of controls.
There is no spreadsheet per standard or folder per audit: there is one control, with its owner, its evidence and its history.
The inventory with its owner, and versioned policies with staff acceptance on record.
Multi-standard mapping of each controlChange history with date and authorPolicy acceptance per personProof is collected from the connected systems, not assembled by hand before each review.
Automatic, dated proofAlerts to the owner, not a shared inboxPermanent audit readinessA register with an impact and likelihood matrix, treatment plans and calculated residual risk.
Inherent and residual matrixA plan with an owner and a deadlineProgress trackingA register of suppliers assessed by criticality, with expiry dates under control and a file for each one.
Assessment by criticalityAlerts for documents about to expireA complete file per supplierA public page where the customer finds what they need without asking by email, and what is confidential stays under NDA.
Public certifications and policiesReports and pentests under NDAA record of who accessed what and whenSecurity questionnaires stop stalling deals: the answers come from an approved library.
A library of validated answersReview before sendingTraceability of what was answered
We use it ourselves first
Despapeliza runs its own public trust center.
See Legale GRC →
What we are proposing is not an idea: it is the tool we use to answer our own customers' audits, with ISO 27001, ISO 27701, ISO 42001, SOC 2 and the Chilean framework over the same inventory.
Next step
Bring the standard you have to meet this year.
An ISO, SOC 2, the data law or your most demanding customer's questionnaire. We build the mapping in the same meeting and you see how the inventory looks.
How many standards do you have to meet this year?
Book a demo →