Your operating model is the program. This canvas makes you design it deliberately: who owns what, how work flows, what escalates to whom, and which forum decides — instead of letting those answers accrete by accident.
Most GRC programs can name their framework in one breath — and then can't tell you who owns a risk decision, what happens when a threshold is crossed, or which forum is allowed to accept a risk. The canvas forces those answers onto paper: every section is a set of questions with a fillable structure, and every section comes with the completed example so you can see what a real answer looks like before writing your own.
What the program exists to do, for whom, and — just as important — what it deliberately doesn't cover.
Core activities — risk assessment, control testing, issue management, incident response, vendor assessment, board reporting — across the three lines.
Step tables for the risk assessment cycle, issue-to-closure, and the incident-to-risk feedback loop that makes evidence flow.
Thresholds tied to the residual scale: what escalates, to whom, in what timeframe — decided before the bad day, not during it.
Forum · purpose · chair · members · frequency · standing inputs · standing outputs · decision rights. If a forum has no decision rights, it's a meeting.
The entire canvas filled in for "Meridian Clearing," a fictional 800-person fintech — opinionated, realistic, and consistent with everything on this site.
The thinking: The PivotRisk Operating Model and Your GRC Operating Model Is the Program.
A 20-page Word document (.docx) plus a PDF reference version. Every table is editable — fill it in, strip the guidance text, and it becomes your operating model document.
No. The canvas scales down: a two-person GRC function still needs to know who decides, what escalates, and on what cadence. The example is a mid-size fintech; the structure works either side of it.
Yes — internally or in client engagements. You can't resell the template itself as a template.
If you want the canvas run as a facilitated working session for your org, get in touch — that's exactly what the advisory engagements are.
Ownership, workflows, escalation, and governance — decided deliberately, written down, and ready to run.