Home / Core
MyRISK Core
Define controls and evidence once. Reuse them everywhere they're asked for.
Core is the assurance layer Trace and Essentials both sit on — one record of controls, evidence, owners and reporting that many different requests draw from, instead of each one being assembled by hand. If that sounds like what a GRC platform is meant to do, you're not wrong — what's different is how the record gets reused.
The problem
The same controls and evidence, assembled by hand, one request at a time.
Reporting, research, credentialing, accreditation, shared-service and supplier questions all ask for versions of the same thing — and most organisations answer each one from scratch, because nothing connects the answer they gave last time to the one they're being asked for now.
Core maps controls, evidence, owners and reporting onto the entities an organisation already uses, so a definition agreed once can serve many requests instead of one.
A shared record doesn't answer every question by itself. It stops every question starting from zero.
Define once, reuse many
- Controls and evidence attached to the entities the organisation already uses
- Owners and review cadence on each definition
- One definition serving reporting, research, credentials and supplier assurance
- Trace attaches where a sign-off must be defended
- Essentials attaches where owners and actions must keep moving
The differentiator
The reuse comes from where the record lives, not from a bigger checklist.
Controls and evidence are vectorised inside the governed enterprise database, on Oracle AI Database 26ai — so matching a framework or analysing a control doesn't mean exporting data out to an external AI service first.
That's the mechanism behind the reuse: the record stays in one governed place, in a form that can be searched and matched directly, so the next request draws on it instead of starting a new document.
What this is, and isn't
- Live today, inside Core
- A platform capability MyRISK has built on, not invented from nothing
- Not an accreditation, a certification, or a claim about any other vendor's approach
Where it's proven today
One live implementation: higher education, through MCDS.
MCDS gives higher education a shared data language for entities, reporting and implementation patterns. MCDS is the sector's data standard — Core is what turns that standard into working assurance operations on top of it. It's the sector Core has an active, time-bound partner route into, and where the pattern below is furthest along.
Core is sold to organisations that already think of this as a GRC problem when they bring one to us — we don't chase that comparison against platforms built for scale, because that's not where Core competes.
MyRISK and MCDS
MyRISK is an MCDS Implementation Partner in the MortarCAPS ecosystem. That is an ecosystem role, not an accreditation or an endorsement — and we will always describe it exactly that way.
The first step
One use case, not a sector-wide programme
Core is sold as a bounded alignment sprint against one named use case — the assurance question that is painful now. The Opportunity Scan comes first: it tests whether one use case is ready and backed, and what the sprint would work from.
Use cases the Scan can start from
- Sector and regulatory reporting cycles
- Research governance and data-sharing assurance
- Credentialing and accreditation evidence
- Shared services assurance
- Supplier and third-party assurance
The Scan needs one named use case, someone senior to back it, and someone who lives with the problem. If those are not in place yet, we will tell you what would need to exist first.
For your reviewers
The boundaries, in writing
Where Core stops
- Not a sector-wide integration programme. One named use case, bounded, first.
- Not MCDS accreditation, certification or endorsement — the implementation-partner classification is an ecosystem role and nothing more.
- Not binding on any institution that has not agreed to a definition.
- Not a substitute for your own risk decisions about your own suppliers.
- Not pursued as a head-to-head replacement for an existing enterprise GRC platform — Core answers that comparison when someone brings it, rather than competing for it directly.
Which assurance question is painful now?
Reporting, research, credentials, accreditation, shared services or supplier assurance. The Opportunity Scan starts with the one that keeps being assembled by hand.