Core · switching from your current GRC
Your GRC renewal is coming. Leave with your records, not a rebuild.
Bring your registers, controls, assessments and supplier questionnaires into Core, run both side by side while you step down users on your current system, and pay only for the people who run risk and compliance. Everyone else stays licence-free.
Why teams switch
The sentences we hear before a renewal
01
“We pay for seats nobody logs into.”
Every contributor, reviewer and respondent licensed, most of them for a form a quarter.
02
“Every change needs the vendor.”
A new field or a changed step becomes a ticket, a quote and a wait.
03
“The same control is assessed for every framework.”
ISO, the ISM, the Essential Eight and a customer questionnaire, each answered from scratch.
04
“We can't trace a risk to the evidence.”
Risk to control, control to test, test to evidence — only after an export to Excel.
05
“Nobody remembers why the workflow has fourteen steps.”
The process grew to work around the system, and now the system is the reason for the process.
06
“Our suppliers won't use the portal.”
So questionnaires go back to email and spreadsheets, outside the system you paid for.
Why configured GRC drifts
Built to do anything, so it holds nothing together.
A general-purpose GRC is configured from a blank canvas: registers, forms and workflows defined by whoever set it up. Over time the same control exists three times under three names, a risk points at a control that was renamed, a finding links to nothing, and every framework is assessed as if the others did not exist. The process grows to work around the model.
Core starts from a risk and assurance data model with the relationships built in, and enforces referential integrity across all of it: every link between a risk, a control, an assessment, a supplier and its evidence is held by the database, so no record can point at something that is not there, and a name is held once at the source, so renaming a control or a risk carries to every record linked to it. The process can stay simple because the model holds it together.
One control record, linked to everything it touches
- Every framework it satisfies, mapped once and reused across them
- Every assessment of it, period by period
- The risks it treats, and the issues raised against it
- The suppliers who operate it, through a portal free for them to answer
- The evidence behind it, maintained in one place
What you gain
One system where there were several
01
One view of your risk data
Risks, controls, assessments, suppliers and evidence in one model, instead of a GRC, a mapping spreadsheet and a reporting extract that disagree.
02
Point tools retired
Questionnaires, framework mapping and the Statement of Applicability live in Core, so the tools bolted on around your current GRC can go with it.
03
A governance team that does governance
Less time reconciling copies and chasing logins; more time on the assessments and decisions the team is there for.
What comes across
Your records, in the form Core uses
Moved for you
- Risk and issue registers, with actions and history
- Your control library and the frameworks you answer to
- Assessments and your Statement of Applicability
- Suppliers, their tiering and their questionnaires
- Evidence and attachments, as files, links or references
How it moves
Every form on every screen in Core imports from CSV, so an export from your current system is usually enough. Where a live connection is worth it, Oracle Integration Cloud — with over 400 adapters, in Oracle's count — reaches the system directly, as priced integration work.
Anything that cannot map cleanly is listed in writing before you commit.
How the switch runs
Three steps, timed to your renewal
01
Map it
An Opportunity Scan, A$5,000: your exports mapped into Core, the gaps listed, and a plan and a price.
02
Run both, and step down
Core alongside your current system through one real cycle — as a 90-day pilot for larger teams. Where your contract allows, reduce its user count as people move across, so you are not paying twice for the same people.
03
Cut over
Move the last users before the renewal date, then let the old contract lapse.
Compare your current licence count with Core's team-size pricing on Core plans and pricing: only the people who run risk and compliance are licensed.
Before you renew
Six questions: fix it, or switch?
| Ask | Points to fixing the workflow | Points to switching |
|---|---|---|
| How do stakeholders and suppliers take part? | They use the system, just late | They are licensed and never log in, or answer by email outside it |
| Where do your risk, control and supplier records live? | In the platform, kept current | In copies across the GRC, spreadsheets and point tools |
| What else supports the GRC function? | Nothing; the platform is used as designed | Separate tools for questionnaires, mapping or reporting |
| How do you measure assurance quality and effort? | Reports exist; nobody acts on them | Only after an export to Excel |
| How do you keep up when a framework or the business changes? | A configuration change your team can make | A vendor ticket, a quote and a wait |
| How do you decide priorities and show the return? | The method is agreed; the discipline is missing | The model cannot link a risk to its controls and their cost |
Two reasons to stay where you are
The workflow is the problem, not the tool
If the platform could do the job and the operating discipline never arrived, moving it will move the problem. Fix the workflow first.
You need breadth Core does not have
Work health and safety, ESG, audit work papers or full incident management. We will say so on the first call rather than after the contract.
For your reviewers
The boundaries, in writing
What this is not
- No claim of feature-for-feature parity with any other product.
- How complete a migration can be depends on what your current system lets you export.
- Your data comes across under your control, and you decide what is kept.
- Nothing is built for you without agreeing a price.
When is your renewal?
Map your records into Core before it arrives, and decide with both systems in front of you.