Your operating model is the program. This canvas makes you design it deliberately: who owns what, how work flows, what escalates to whom, and which forum decides, instead of letting those answers accrete by accident.
Most GRC programs can name their framework in one breath, and then can't tell you who owns a risk decision, what happens when a threshold is crossed, or which forum is allowed to accept a risk. The canvas forces those answers onto paper: every section is a set of questions with a fillable structure, and every section comes with the completed example so you can see what a real answer looks like before writing your own.
What the program exists to do, for whom, and (just as important) what it deliberately doesn't cover.
Core activities, risk assessment, control testing, issue management, incident response, vendor assessment, board reporting, across the three lines.
Step tables for the risk assessment cycle, issue-to-closure, and the incident-to-risk feedback loop that makes evidence flow.
Thresholds tied to the residual scale: what escalates, to whom, in what timeframe, decided before the bad day, not during it.
Forum · purpose · chair · members · frequency · standing inputs · standing outputs · decision rights. If a forum has no decision rights, it's a meeting.
The entire canvas filled in for "Meridian Clearing," a fictional 800-person fintech, opinionated, realistic, and consistent with everything on this site.
The thinking: The PivotRisk Operating Model and Your GRC Operating Model Is the Program.
A 20-page Word document (.docx) plus a PDF reference version. Every table is editable, fill it in, strip the guidance text, and it becomes your operating model document.
No. The canvas scales down: a two-person GRC function still needs to know who decides, what escalates, and on what cadence. The example is a mid-size fintech; the structure works either side of it.
Yes, internally or in client engagements. You can't resell the template itself as a template.
If you want the canvas run as a facilitated working session for your org, get in touch, that's exactly what the advisory engagements are.
Ownership, workflows, escalation, and governance, decided deliberately, written down, and ready to run.