GUIDE · Governance, Risk & Compliance
Governance That Holds Up in the Boardroom and in the Audit.
We build the policies, controls and evidence model that let you prove compliance continuously instead of scrambling before each review.
- Audit-ready compliance
- Less duplicated control effort
- Leadership visibility of control health
- 1Scope Obligations
- 2Assess Current State
- 3Design Unified Controls
- 4Operationalize the Workflow
- 5Monitor and Report
Executive Summary
- 01One control library, mapped to every framework that applies, replaces separate checklists and removes repeated evidence requests.
- 02Risk ranking decides how deeply each control is tested, so effort follows exposure rather than audit calendars.
- 03Evidence captured as work happens turns an audit request into a query instead of a project.
The Challenge
Many institutions manage compliance in spreadsheets, with evidence spread across teams and frameworks mapped one at a time.
The result is duplicated effort, audit fatigue and little insight into which controls are actually effective.
The DAAKYI Approach
We design a single control framework mapped across the standards you must meet, then implement the governance, workflow and evidence practices to run it.
Where it helps, GRC tooling automates mapping, evidence collection and reporting.
- 01
Unified control library across frameworks
- 02
Policy and standards set
- 03
Evidence and attestation workflow
- 04
GRC tooling configuration
In Depth
How the Discipline Works
Control Design Starts with Obligations
Compliance work begins with a register of obligations. Each requirement from a standard, regulation or contract is broken into a testable statement. Many statements say the same thing in different words. Access review, for example, appears in ISO/IEC 27001, PCI DSS, SOC 2 and in regulator directives. Those statements are grouped into one control with a named owner, a defined frequency and a stated test. The framework citations become metadata attached to the control rather than separate checklists. This is what makes one control satisfy several reviews, and it gives every owner a single instruction instead of several overlapping ones.
Risk Decides Control Depth
Not every control deserves the same rigor. A risk assessment, run in line with a method such as ISO 31000, ranks assets, threats and impact so that effort follows exposure. High-risk processes get tighter testing and more frequent evidence. Low-risk ones get lighter checks. The risk register links to the control library, so a failed control raises a measurable risk instead of a vague finding. Leaders can then accept, treat, transfer or avoid each risk on the record. Without that link, compliance becomes a catalog of activity with no reasoning behind it, and auditors will notice the gap between what is documented and what is exposed.
Evidence as a Byproduct of Operations
Evidence should be produced by the work, not assembled afterward. A ticket closed with approval, a configuration export, an access review sign-off and a training record are all evidence if they are captured with a timestamp and an owner. The workflow defines what artifact proves each control, where it is stored and who attests to it. Automated collection suits technical controls such as logging and encryption settings. Human attestation suits policy and process controls. Retention rules keep records for as long as the strictest applicable framework requires. When an auditor asks for a sample, the answer is a query, not a project.
A control you cannot test, own and evidence is a statement of intent, not a safeguard.
Capability Matrix
What the Service Includes
| Capability | Coverage | GUIDE | SECURE | OPERATE | Delivered Through |
|---|---|---|---|---|---|
| Policy and Governance Design | Policies, standards and committee structures. | GUIDE stage | – | – | Advisory Engagements, Project Implementation |
| Control Framework Mapping | One control set mapped to many standards. | GUIDE stage | – | – | Advisory Engagements, Project Implementation |
| GRC Tooling and Automation | Workflow, evidence and reporting automation. | GUIDE stage | – | – | Advisory Engagements, Project Implementation |
| Compliance Reporting | Dashboards that show control health to leadership. | GUIDE stage | – | – | Advisory Engagements, Project Implementation |
Policy and Governance Design
Policies, standards and committee structures.
- Stage
- GUIDE
- Delivered Through
- Advisory Engagements, Project Implementation
Control Framework Mapping
One control set mapped to many standards.
- Stage
- GUIDE
- Delivered Through
- Advisory Engagements, Project Implementation
GRC Tooling and Automation
Workflow, evidence and reporting automation.
- Stage
- GUIDE
- Delivered Through
- Advisory Engagements, Project Implementation
Compliance Reporting
Dashboards that show control health to leadership.
- Stage
- GUIDE
- Delivered Through
- Advisory Engagements, Project Implementation
How It Works
How Governance, Risk & Compliance Works
- 01Frameworks
- 02Unified Controls
- 03Evidence
- 04Reporting
Methodology
The Method, Step by Step
- 1
Scope Obligations
List every standard, law and contract that applies, and the business units, systems and data each one touches. Confirm applicability decisions with legal and risk leads. Record exclusions with reasons. A clear scope prevents both over-auditing and surprise findings, and it fixes the boundary the later steps depend on.
- 2
Assess Current State
Compare existing policies, practices and evidence against the requirements. Interview control owners and sample real artifacts rather than relying on written procedures. Rate each gap by risk and effort. The output separates controls that work, controls that exist only on paper and requirements nobody currently owns.
- 3
Design Unified Controls
Consolidate overlapping requirements into a single control library. Write each control with an objective, owner, frequency, test procedure and evidence artifact. Draft the policies and standards that sit above it. Review the design with the people who will operate it, so controls fit real workflows and are not rejected on first contact.
- 4
Operationalize the Workflow
Assign owners, schedule control tests and configure evidence capture. Connect the register to ticketing, identity and cloud sources where automation is practical. Define the exception process, including approval authority and expiry dates. Run a dry-run review so gaps in evidence surface before an external assessor finds them.
- 5
Monitor and Report
Track control status, overdue evidence, open exceptions and remediation progress. Present results to leadership in terms of risk, not task counts. Review the library whenever a framework revises or the business changes. Governance committees use the same data to set priorities and fund fixes.
Operating Model
Delivered from the GUIDE Pillar
Pillar position
GUIDE
Advisory, Risk & Assurance
Engagement model
Advisory Engagements
Fixed-scope assessments, strategy, compliance and testing.
Best for · Defined questions with a clear deliverable
Engagement model
Project Implementation
Design and deployment of security technologies.
Best for · Modernization and transformation
Threat Scenarios
What It Looks Like in Practice
Overlapping Audits in One Quarter
How It Shows Up
Different assessors ask the same teams for the same screenshots and logs in different formats.
Response
Map each control once to all frameworks and reuse a single evidence set, so one artifact answers every request.
Control Drift After a Passed Audit
How It Shows Up
A setting that met a control last year was changed during a migration, and nobody noticed until the next review.
Response
Schedule automated or periodic tests per control, alert the owner on failure and track the fix to closure.
Breach with Unclear Notification Duties
How It Shows Up
After an incident, teams argue over who must notify which regulator and by when, while the clock runs.
Response
Build notification obligations, such as the GDPR 72-hour expectation and Act 1038 incident reporting, into incident procedures with a named decision owner.
Policies That Engineers Never See
How It Shows Up
Approved policies exist, but operating teams cannot say which standard governs a given system.
Response
Translate policies into technical standards and control tests, and record every deviation as an exception with an owner and an expiry date.
| Scenario | How It Shows Up | Response |
|---|---|---|
| Overlapping Audits in One Quarter | Different assessors ask the same teams for the same screenshots and logs in different formats. | Map each control once to all frameworks and reuse a single evidence set, so one artifact answers every request. |
| Control Drift After a Passed Audit | A setting that met a control last year was changed during a migration, and nobody noticed until the next review. | Schedule automated or periodic tests per control, alert the owner on failure and track the fix to closure. |
| Breach with Unclear Notification Duties | After an incident, teams argue over who must notify which regulator and by when, while the clock runs. | Build notification obligations, such as the GDPR 72-hour expectation and Act 1038 incident reporting, into incident procedures with a named decision owner. |
| Policies That Engineers Never See | Approved policies exist, but operating teams cannot say which standard governs a given system. | Translate policies into technical standards and control tests, and record every deviation as an exception with an owner and an expiry date. |
Outcomes
What Your Institution Gains
- Audit-ready compliance
- Less duplicated control effort
- Leadership visibility of control health
Deliverables and Roles
What You Receive, and Who Does What
| Deliverable | Purpose |
|---|---|
| Obligations Register | Records every applicable standard, law and contract requirement with its owner and applicability decision. |
| Unified Control Library with Crosswalk | Gives each control one definition, one test and a mapping to every framework it satisfies. |
| Risk Register Linked to Controls | Shows which control failures create which risks, so treatment decisions are traceable. |
| Evidence Matrix and Retention Schedule | States what proves each control, where it lives and how long it must be kept. |
| Control Health Report | Summarizes effectiveness, exceptions and overdue items in a form the board can act on. |
| Role | Responsibility |
|---|---|
| Board or Risk Committee | Sets risk appetite, approves the policy set and reviews control health at a regular cadence. |
| CISO or Head of Security | Owns the control framework and answers for the gap between documented and operating controls. |
| Control Owner | Operates a specific control, supplies its evidence and reports failures or exceptions promptly. |
| GRC Consultant (Provider Side) | Designs the library, crosswalk and workflow, and helps the client's teams run them until they are self-sufficient. |
Maturity Model
Where Organizations Typically Stand
Stage 1
Ad Hoc
Compliance is handled per audit in spreadsheets, and evidence is gathered under deadline pressure.
Stage 2
Defined
Policies, owners and a control list exist, but frameworks are still mapped separately and testing is irregular.
Stage 3
Managed
A unified library, scheduled tests and an evidence workflow operate, and exceptions are tracked to expiry.
Stage 4
Continuous
Control status updates automatically where feasible, risk informs test depth, and leaders steer from live data.
Frameworks and Regulation
The Standards That Shape This Work
ISO/IEC 27001:2022
Annex A lists 93 controls in four themes: organizational, people, physical and technological. ISO/IEC 27002:2022 provides the implementation guidance, and the Statement of Applicability records which controls apply and why.
NIST CSF 2.0
Released in February 2024, it has six functions: Govern, Identify, Protect, Detect, Respond and Recover. The Govern function places risk strategy, roles and policy at the center of the program.
PCI DSS v4.0.1
This is the current revision of version 4.0. Its future-dated requirements became mandatory on 31 March 2025, so assessments now cover them in full.
Ghana Acts 843 and 1038
Act 843 requires data controllers to register and sets eight privacy principles. Act 1038 established the Cyber Security Authority and provides for Critical Information Infrastructure, accreditation of providers and incident reporting.
Buyer Guidance
Choosing the Right Provider
What to look for
- Look for a provider that begins with your obligations and risks, not with a tool demonstration.
- Look for control definitions that include owner, test procedure and evidence artifact, not just a requirement description.
- Look for mappings that show partial coverage honestly rather than claiming every control satisfies every clause.
- Look for a plan to transfer operation to your teams so the program survives after the engagement ends.
Questions to ask a provider
- How do you handle a requirement that a control only partly satisfies?
- Can you show a sample control with its owner, test and evidence artifact?
- How will the framework update when a standard is revised?
- Which parts of evidence collection can be automated, and which need human attestation?
Regulatory & Industry Context
The Obligations This Service Supports
Control sets commonly span ISO/IEC 27001, SOC 2, PCI DSS, NIST CSF and COBIT, together with Ghana's Act 1038 and Act 843 where they apply.
Frameworks DAAKYI helps clients implement
- ISO/IEC 27001
- SOC 2
- PCI DSS
- NIST CSF
- COBIT
- Ghana Act 1038
Framework references describe client implementation support, not DAAKYI certifications.
Technical Detail
For Architects and Security Leads
Telemetry sources and partner technologies
Technology partners DAAKYI works with in this area.
Framework and regulatory alignment
- ISO/IEC 27001
- SOC 2
- PCI DSS
- NIST CSF
- COBIT
- Ghana Act 1038
Control sets commonly span ISO/IEC 27001, SOC 2, PCI DSS, NIST CSF and COBIT, together with Ghana's Act 1038 and Act 843 where they apply.
Architecture reference
How Governance, Risk & Compliance Works: Frameworks → Unified Controls → Evidence → Reporting.
We design a single control framework mapped across the standards you must meet, then implement the governance, workflow and evidence practices to run it.
Designing the Control Crosswalk
A crosswalk maps each control to requirement identifiers in every applicable framework. The relationship is rarely one to one. A single control may fully satisfy one requirement and only partly satisfy another, so each mapping carries a coverage rating and a note on the gap. Granularity matters. Mapping at the level of an ISO/IEC 27001 Annex A control to a whole PCI DSS requirement hides detail that assessors will test. Store mappings as structured data, with versioned framework baselines, so a revision such as a new PCI DSS release produces a visible diff instead of manual rework. Review partial mappings first, because those are where audit findings concentrate.
Continuous Control Monitoring Design
Continuous monitoring turns a control test into a repeatable query. For technical controls, define the data source, the pass condition and the evaluation interval. Examples include whether multifactor authentication is enforced on administrator accounts, whether storage encryption is enabled, and whether log forwarding is active. Record each result with a timestamp so the history itself becomes audit evidence. Alert the control owner on failure and open a ticket with an expiry for any approved exception. Keep manual attestations in the same register so leaders see technical and procedural controls in one view. Validate the collectors periodically, because a broken integration can look like a passing control.
Glossary
Key Terms
- Crosswalk
- A mapping table that links one control to the matching requirements in several frameworks.
- Statement of Applicability
- An ISO/IEC 27001 document listing which Annex A controls apply and justifying any exclusions.
- Attestation
- A recorded confirmation by a named owner that a control operated as designed during a period.
- Compensating Control
- An alternative safeguard that meets a requirement's intent when the stated control cannot be implemented.
Related
Explore Connected Capabilities
Platforms
Proof Points
What We Can Stand Behind
- Every stage of DAAKYI's delivery methodology produces documented, auditable deliverables.
Technology partners
FAQ
Questions Leaders Ask
DAAKYI Intelligence
Ask Kasara About Governance, Risk & Compliance
Kasara, our AI assistant, answers from DAAKYI's published content and can connect you with a specialist.
Next Step
Discuss Governance, Risk & Compliance with DAAKYI
Tell us about your environment and obligations. A DAAKYI specialist for Governance, Risk & Compliance will respond.
Talk to a Cybersecurity Expert