GRC Suite: learn the complete process

GRC Suite connects risk, compliance, internal controls, audit and corrective work inside Railbase. Start with a business objective and an accountable person; follow the evidence through review to a saved result.

Before you start

Your operator installs the licensed GRC Product in Railbase. Sign in with your own identity, select the intended company and open Help · Tutorials, then choose Product practice in the topic filter. The library shows lessons provided by your installed release and role. Search for the lesson title below. If a lesson is missing, ask the operator to check the installed GRC release and your company role; a site administrator account alone does not grant company access.

The interactive lessons use fictional Acme examples and English instructions, like Railbase's own learning library. You can pause, resume after reloading and restart a lesson. Your answers are personal to you and the selected company. Practising another person's review does not give you that person's real permissions. The exercises do not create real risks, cases, payments, workflows or approvals.

Follow the learning path

Lesson	Practise as	Result of the exercise
GRC: follow an issue to verified closure	GRC team and business owners	A source-and-scope record, accountable handoff and evidence-based closure plan.
Risk management: from register to review	Risk owner, action owner and risk expert	Identification, supported assessment, response and independent action acceptance.
Internal Control: from process to follow-up	Internal Control expert	A plan covering process, risks, coverage, owners, versions, testing and sources.
Build a risk-control matrix	Internal Control and business owners	A reviewed practice matrix with separate process and control ownership.
Assess control design	Internal Control expert and reviewer	Design criteria, evidence, limitations and a reviewed conclusion.
Select controls for a testing plan	Expert, manager and function head	Explicit selection, justified exclusions, assignments and plan approval.
Compliance: investigate and resolve a case	Compliance expert and function head	Applicable obligation, supported case review and corrective-work plan.
Audit: from finding to reviewed report	Audit team, reviewer and action owner	A scoped finding, independent follow-up and review of the exact report revision.
Smith: review a proposal before using it	GRC expert and authorised reviewer	A bounded request, rejection of an unsupported claim and a human-review plan.

Start with the GRC lesson, then follow the lessons for your actual job. Existing Risk and Internal Control lessons retain their established role restrictions. The four cross-functional GRC lessons are available to GRC Product roles; all business operations keep their own access checks.

Work through a lesson

1. Open the lesson and read its fictional evidence and expected output.
2. Select Start workshop, complete the highlighted task and save it. Available selectors refer to the practice roster, not the live employee directory.
3. For a supported-decision question, read the evidence before choosing. An unsupported conclusion produces an explanation and leaves the task open. Correct it and retry.
4. Pause when needed. Reopen the lesson or reload to confirm that your saved answers and current task remain available. A cancelled or unsaved edit is not a completed step.
5. Finish the last task and inspect your saved record and history. Restart only when you intend to repeat the exercise; the confirmation prevents an accidental reset.

If a save fails, keep your answers and retry. If another tab changed the same lesson, reload the current revision before continuing. Repeating the same save must not advance the lesson twice. Switching company gives you that company's separate learning record.

Apply the process to real work

Use your real workspace and authority after the exercise. Select the company, open the assigned object and inspect its current version and scope. Retain the source identity, period and version when evidence passes between workspaces. Repeated delivery is not a second business fact; missing or stale evidence is not a positive control result.

Owners confirm facts and perform corrective actions. Authorised independent reviewers accept supported results. A new control design is not proof that it operated; a completed action is not automatically a closed finding. Review the exact report revision being issued and retain its decision history.

Check the whole result: your role → your actions → the visible outcome → the saved state after reopening. Inspect the status, linked evidence, ownership, version and history. If access is denied, ask for the required scoped assignment rather than using another person's identity. If delivery fails, inspect the error and retry the existing operation instead of duplicating the business object.

Use Smith with human review

The Smith lesson uses a fixed proposal and does not call a model or spend AI credits. Real Smith execution requires an operator-configured and approved model connection, an admitted context policy and the appropriate company/object permissions. A local test connection is not approval to send customer data.

Inspect the evidence behind each suggestion. Accepting drafting assistance does not assign owners, publish a matrix, certify effectiveness or sign a report. Keep those decisions in the authorised human workflow. If the provider is unavailable or a request is cancelled, inspect the saved request status before retrying.

Purchase and deployment

The GRC Product page shows current availability and the approved offer. Basic, Pro and Max include the same GRC capability with different annual audit-engagement capacity. Purchase uses a verified company and an authorised billing account; prices and applicable tax are confirmed before payment. Individual components have no separate checkout.

GRC offer · Railbase learning · Business Suite scope · Deployment choices