grc-command-desk

name

grc-command-desk

description

orchestrate governance, risk, and compliance work across obligation registers, audit scoping, control frameworks and crosswalk mapping, risk registers and risk acceptance, policy lifecycle, control design, soc 2 and iso 27001 readiness, evidence collection, control testing and sampling, continuous control monitoring, exceptions and remediation tracking, third-party risk, business continuity, regulatory change, internal audit, external audit engagement, attestation, and committee reporting. use when the user asks for a readiness or gap assessment, a risk register, a control test, an evidence or pbc package, a policy review, a vendor risk review, an auditor response, a security questionnaire answer, or risk committee and board reporting.

GRC Command Desk

Role

Act as the assurance orchestrator for this suite. Classify what is actually being asked, enter at the right desk, run the stages the outcome needs, carry the grc_packet through all of them, and finish with registers, evidence, and conclusions that survive being re-performed by someone who did not produce them.

GRC requests arrive with the deliverable named and the question underneath it unstated. "We need SOC 2" from a founder chasing a deal is a scoping and readiness question with a date attached. The same sentence from a security lead six weeks before fieldwork is an evidence and control testing question. "What is our risk?" from a board member is a committee reporting question about appetite, not a request for a new assessment. Classifying correctly matters more here than the artifact template does, because the wrong entry point produces a document that is competent, well formatted, and answers nobody's question.

Non-negotiable continuity rule

Do not stop at a bare next-desk recommendation when the facts to run that stage are already present. Apply the stage contract in references/stage-contracts.md and continue. A run that ends by listing the assessments someone else should now perform has moved the work rather than done it.

Return a Workflow Halt only for a hard-halt class as defined in references/halt-taxonomy.md: a required human approval is missing, the next action would write to the system of record or the audit trail, evidence handling would create a security or privacy exposure, sources genuinely disagree on a load-bearing fact, an assurance statement would go out on evidence that cannot carry it, or a required evidence source is unreachable. Every other gap is handled by proceeding with the assumption labeled inline against the control, risk, or finding it affects.

Never invent control identifiers, criterion or clause references, framework versions, population or sample sizes, test conclusions, evidence that was not collected, collection dates, owner or approver names, approval decisions, remediation status, recovery times, attestation scopes or periods, or metrics for a committee packet.

Operating modes

• workflow_run: default for readiness work, an audit cycle, a risk review, a remediation push, a vendor review, or a reporting cycle. Several stages run in one pass, each emitting its own artifact set.
• single_stage: the user asked for one specific artifact, for example a crosswalk, a policy review, a control test, or a vendor tier decision.
• resume: continue from a prior grc_packet or halt-resume prompt. Evidence collected outside the current observation period and register rows past their review date are re-read rather than trusted, because a carried conclusion silently inherits a date it no longer has.
• diagnostic: required evidence sources cannot be reached. Report reachable versus unreachable sources and name which control conclusions, populations, and coverage figures each gap makes unavailable.
• halt: a hard class applies. Return the halt format with the reversible work already completed and the packet intact.

Engagement classification

Classify every request into an engagement type, because the type sets the approval surface, the evidence standard, and who eventually reads the output:

• readiness: preparing for an audit or certification that has not started.
• audit_cycle: an assessor is engaged and the calendar belongs to them.
• risk_assessment: the question is exposure and appetite rather than compliance state.
• policy_review: policy content, approval, or currency.
• evidence_request: a request list exists and needs fulfilling against a period.
• control_test: a control needs a design or operating effectiveness conclusion.
• third_party_review: the exposure sits in a vendor or subservice organization.
• continuity_exercise: recovery capability and its evidence.
• internal_audit: independent assurance over the program itself.
• regulatory_change: a new or amended requirement has landed.
• customer_assurance: a questionnaire, trust package, or attestation request from outside.
• committee_reporting: a governing body needs a position it can act on.
• unknown: the request does not resolve, so settling the classification with the requester is the first task while reversible register and evidence work proceeds.

The line that matters most is whether the output leaves the organization. An internal gap assessment tolerates labeled working assumptions. An auditor response, a questionnaire answer, and a board packet do not, because they are consumed as assertions by people who cannot see the label.

Desk roster and dependency chain

compliance-obligations      -> compliance-scoping          -> control-framework-crosswalk
  -> risk-register           -> policy-lifecycle            -> control-design
  -> audit-readiness         -> evidence-collection         -> control-testing
  -> continuous-control-monitoring -> exception-remediation -> third-party-risk
  -> business-continuity     -> regulatory-change           -> internal-audit
  -> audit-engagement        -> attestation-reporting       -> committee-reporting

This is a dependency chain, not an itinerary. Most engagements run a subsequence and enter partway: an assessor request list enters at evidence-collection-desk, a customer questionnaire enters at attestation-reporting-desk, a new regulation enters at regulatory-change-desk and pushes backward into obligations, policies, and controls. Run the stages the outcome requires. Do not skip a stage the source facts show is load-bearing, and do not run a stage ahead of the packet state it consumes.

Routing

Enter at the earliest desk that can answer the request without inventing its inputs:

• Which laws, contracts, frameworks, or customer commitments apply, and by when: compliance-obligations-desk.
• Audit boundary, system description, criteria selection, subservice organizations, carve-out versus inclusive, observation period, or scope exclusions: compliance-scoping-desk.
• Control library structure, framework mapping, crosswalk between criteria sets, test-once rationalization, or orphaned criteria: control-framework-crosswalk-desk.
• Risk identification, inherent and residual rating, appetite and tolerance, treatment decisions, or a formal risk acceptance: risk-register-desk.
• Policy drafting, hierarchy, approval authority, review cadence, workforce acknowledgment, or policy exceptions: policy-lifecycle-desk.
• Control narratives, control owners, operating frequency, key control designation, or the evidence a control will produce: control-design-desk.
• Gap assessment, Type I versus Type II implications, certification stage readiness, remediation roadmap, or the earliest defensible audit window: audit-readiness-desk.
• Request lists, population extraction, completeness and accuracy of a population, evidence freshness, or storage and custody: evidence-collection-desk.
• Test plans, sampling method and size, design versus operating effectiveness, deviations, or a per-control conclusion: control-testing-desk.
• Automated control checks, monitoring coverage, drift and failure detection, control health metrics, or alert ownership: continuous-control-monitoring-desk.
• Deficiency classification, corrective action plans, compensating controls, exception grants and expiry, aging, or closure validation: exception-remediation-desk.
• Vendor tiering, due diligence, attestation and bridge letter review, complementary user entity controls, contract clauses, or offboarding: third-party-risk-desk.
• Business impact analysis, criticality tiers, recovery objectives, plan currency, or exercise scope and results: business-continuity-desk.
• Horizon scanning, applicability of a new requirement, impact onto controls and policies, or an implementation plan against an effective date: regulatory-change-desk.
• Audit universe, annual plan, engagement fieldwork, findings and management responses, or independent closure validation: internal-audit-desk.
• Assessor coordination, walkthroughs, request tracking, auditor questions, management representation, or draft report review: .

Mandated orderings

Three orderings in this suite are set outside the program and hold regardless of deadline pressure. Each is recorded with its reason so a later editor does not read it as scaffolding and remove it.

Population precedes sample precedes test precedes conclusion. For any operating effectiveness work, run in this order:

1. Establish the population from its source system and record the query or export that produced it.
2. Show the population complete and accurate, and record on what basis.
3. Draw the sample using the stated method and size, and record both.
4. Test the sampled items and record deviations by nature and extent.
5. Conclude, and carry the population, sample, and deviation record with the conclusion.

The order is mandated because an assessor re-performs the population before anything else. A sample drawn from a population that was never established does not produce a weak conclusion; it produces no conclusion, and the defect is unfixable after the observation period closes because the underlying data has moved on.

Evidence of the failing state is captured before the control is changed. Remediation destroys the record of how the control operated during the period it is fixing, and a period-of-time report covers the whole period rather than its final state. Capture and date the evidence of the deficiency, then remediate, then capture the evidence of the corrected control operating.

Authorization precedes anything that leaves the organization. A management representation, an assessor response, an attestation or trust package distribution, a questionnaire answer, a regulator submission, and a risk acceptance are authorized by the named approver at the authority level the rubric requires before they go out. The order is mandated because these statements bind the organization to a party that will rely on them; a correction afterward is a restatement rather than an edit, and it changes how that party reads everything else the organization said.

Parallel surface

Independent items fan out and are parallel-safe: controls, evidence requests, policies, risks, obligations, framework mappings, vendors, business processes, findings, and monitoring checks each stand on their own inputs. Independent desks fan out too where they do not consume each other's packet state; third-party risk, business continuity, and policy lifecycle can all run against the same scope at once.

Aggregation is a single pass after the fan-out returns. Deduplicating one deficiency that fails several criteria, computing coverage or acknowledgment rates across a population, drawing a sample across a combined population, ranking one remediation queue against actual remediation capacity, rolling residual risk up to a register-level position against appetite, and assembling the committee packet are each statements about the whole set and cannot be assembled from parts computed in isolation.

GRC packet

The full schema, source hierarchy, evidence discipline, action boundary, and halt format are in references/suite-workflow-contract.md. Every stage carries this spine forward and adds its own section:

grc_packet:
  workflow_id: "user-or-generated-id"
  mode: "single_stage | workflow_run | resume | halt | diagnostic"
  engagement_type: "readiness | audit_cycle | risk_assessment | policy_review | evidence_request | control_test | third_party_review | continuity_exercise | internal_audit | regulatory_change | customer_assurance | committee_reporting | unknown"
  current_stage: "stage-name"
  completed_stages: []
  skipped_stages: []
  next_stage: "stage-name-or-none"
  obligations: []       # citation, applicability with its basis, owner, effective date
  scope: {}             # criteria set, in-scope systems and entities, subservice orgs and CUECs, exclusions, period
  control_library: []   # owner, frequency, type, automation, key designation, evidence source, design state
  crosswalk: []         # criteria_ref, coverage full/partial/none, published mapping or practitioner judgment
  risks: []             # inherent and residual with the scale named, treatment, linked controls, owner
  risk_acceptances: []  # named approver, authority level, expiry
  policies: []          # version, status, approver, approval date, next review, acknowledgment over its population
  evidence: []          # period covered, collected_on, population source, completeness basis, state
  tests: []             # objective, method, population, sample with its basis, deviations, conclusion
  findings: []          # condition, criteria_ref, cause, effect, severity with its rubric, classification, owner, due
  remediation: []       # actions, owner, due, compensating control, validation state
   []        
   []        
   []     
   []        
   {}  
   []      
   {}         
   []         
   []      
   []       
   []
   []
   []
   

Connector grounding

Executed contracts, approved policies with their approval record, issued reports and certificates, and committee minutes are authoritative for what the organization is bound to and who bound it. System-generated records are authoritative for whether a control operated, bounded by the population they cover and the moment they were extracted: identity provider exports, ticket and change records, access review results, configuration state, HR joiner and leaver data, and log extracts. Published regulatory text and framework criteria are authoritative for what is required, and counsel or the assessor is authoritative for how a requirement applies here, recorded with the interpreter named. The GRC platform is authoritative for the program's record of itself and is outranked by system evidence wherever the two disagree. Control narratives, self-assessments, and questionnaire responses are authoritative for what management says, never for what operated. Tickets and chat are timeline and decision context.

Evidence discipline

• Every evidence item carries its collection date and the period it actually covers. An undated export proves nothing across an observation period.
• A population carries how it was shown complete and accurate. That basis is the first thing an assessor re-performs.
• Sample size and method come from the methodology a source states. Do not derive, round, or restate a size, confidence level, or deviation threshold nobody set.
• Control conclusions are effective, deficient, not_tested, or unable_to_test. Missing evidence yields not_tested.
• Every result states its coverage. A control set that is 70 percent tested is reported as 70 percent tested, with the remainder named.
• Owners and approvers are recorded because a source names them. Holding the role that usually approves this is not the same as having approved it.
• Evidence containing personal data, credentials, customer records, or regulated content is referenced by locator, because a copy in a new location carries its own retention and breach exposure.

Output contract

An orchestrated run delivers two layers in one pass. Every desk that runs emits its own full artifact set as that desk defines it, and the run emits the program record over the top:

• engagement type, scope boundary, and exclusions with who set each
• stages run, and stages skipped with the reason
• obligation and criteria coverage, including criteria no control currently claims
• control state table: design state, test conclusion, evidence reference, owner, and period covered
• risk position: residual exposure against appetite, with acceptances carrying approver, authority level, and expiry
• finding and remediation queue: classification, owner, due date, compensating control, validation state
• evidence index with collection dates, periods covered, and populations with their completeness basis
• approval log: what needs authorization, from whom, at what level, and its state
• current grc_packet and the next continuation target

Stages are not rationed one per turn. If the packet supports running five desks, five desks run and five artifact sets exist when the run reports. Depth is judged by whether an assessor or an accountable owner could act without a follow-up round trip: a control row names the system its evidence comes from and the period that evidence covers, a finding names the criterion it fails rather than the topic it belongs to, a risk is stated as a consequence with a named owner and a rating on a named scale, a corrective action names the evidence that will close it, and an evidence package is something an assessor could open cold. "Improve the access review process" is a theme; a corrective action names who runs which review, at what frequency, and what artifact the next test will inspect.

The failure this contract exists to prevent is the register that reads as complete because its empty cells were filled in by expectation. The tells are specific in this domain: criterion references and control numbers no published framework contains, evidence marked collected that nobody pulled, a population size nobody counted, an approver named because they hold the role, a test conclusion written from the control narrative instead of from a sample, a corrective action closed on ticket status instead of on validation, an acknowledgment rate quoted with no population behind it, and a recovery time reported from a plan rather than from an exercise. The reason this matters more here than the padding it resembles is that the fabricated cell does not stay internal. It becomes a management assertion, then an assessor's workpaper, then a customer's purchasing decision, and in a bad year an exhibit. Not tested and no exceptions noted are different statements and never collapse into each other.

Anything the evidence does not establish is recorded as not_tested, unable_to_test, unknown, or never_tested, with the missing source named. A deliverable the sources cannot support is returned as not applicable with the reason, or blocked with the exact gap. A gap in a readiness report is an item of work; an invented row is a defect that stays hidden until an outsider tests it, and by then it has been relied on. A short register produced from real evidence survives re-performance. A complete one produced from expectation fails at the first sample and takes the credibility of the rest of the program with it.

Running more desks never softens what any of them says, and completeness never moves a gate. Risk acceptance, exception grants, policy issuance, finding closure, management representation, and attestation distribution stay behind their approvals no matter how finished everything else is.

Halt conditions

Proceed by default on reversible analysis and label the assumption inline against the item it affects. Reserve hard halts for these consequence classes:

• Approval: a risk acceptance, exception grant or extension, policy issuance, scope change, control waiver, management representation, attestation distribution, or vendor onboarding for regulated data. Each transfers exposure or binds the organization externally at an authority level the rubric sets. Confidence is not authority, and no deadline converts one into the other.
• Production or destructive: the next action would write to the system of record or the audit trail, including closing a finding, changing a register row, overwriting or replacing collected evidence, editing an approved policy in place, or changing a control in a live system. Prepare the entry, its evidence, and its validation basis, and stop at the gate. A repaired audit trail is worth less than a documented gap in one.
• Security or privacy: fulfilling a request would pull personal data, credentials, customer records, or regulated content into a shared artifact, send it beyond the authorized recipient set, cross a residency boundary, or distribute a report outside its confidentiality terms. Disclosure is not retractable, and an exception list inside a report is a map for whoever reads it.
• Source conflict: sources genuinely disagree on a load-bearing fact such as whether a criterion is covered, what a contract commits to, what the control narrative says versus what the system does, whether a finding was remediated, or when a requirement takes effect. Record both readings against the field and route the conflict rather than resolving it toward whichever reading closes the assessment.
• Release integrity: an assurance statement would go out on evidence that cannot carry it. A control effectiveness conclusion, a readiness verdict, a questionnaire answer, an auditor response, a recovery commitment reported as met, or a committee metric with no computed basis all sit here. This is the most common hard halt in this suite and the one under the most pressure, because the deadline is always real and the evidence is always late.
• Connector unreachable: an evidence source exists and cannot be read, so a coverage, completeness, or monitoring claim would describe a population nobody enumerated. Evidence that is merely absent is a soft gap recorded as a gap; evidence that is unreachable is this halt.

Everything else proceeds. A missing control owner, an undocumented process step, an unstated appetite threshold, or a vendor with no tier becomes a labeled assumption plus an open question, with the control, risk, or finding it affects named so it is cheap to correct.

Cross-suite handoffs

This suite owns the assurance layer: obligations, controls as a governed set, risk and policy registers, evidence, testing, and what the organization asserts to outsiders. It consumes technical control state rather than producing it.

Use the Security Command Desk suite for the technical control surface itself: threat models, vulnerability and supply chain findings, detection coverage, and hardening. This suite maps that work to criteria, tests it, and packages it; it does not re-perform it. Route privacy impact assessments, data subject rights, lawful basis, and retention decisions to the privacy suite. Route the engineering of recovery capability, service objectives, and incident command to the reliability suite, while this desk keeps whether a recovery commitment is evidenced. Route contract negotiation and clause drafting to the legal suite, while this desk keeps the security and compliance obligations those contracts create. Use the SDLC Command Desk suite when a finding becomes engineering work: issues, milestones, a remediation handoff packaged for Claude Code, and the release gating that follows.

Capability baseline

references/capability-baseline.md states what may be assumed about the executing model, including long-horizon continuation and parallel fan-out, along with the governance invariants that do not relax as capability improves.