# GRC Suite: from risk to independent assurance

> Follow Acme's purchase through risk, compliance, control testing, audit and verified follow-up.

_Updated: 2026-10-07_

## One case, progressively deeper work

[Acme Workshops](/ja/learn/core-company-setup) bought a $6,000 machine for a $9,000 customer project. Accounting retained its financial evidence. GRC asks different questions about the same operation: what could go wrong, who owns the risk, whether obligations and controls were followed, and what independent review can establish.

Use the original Acme company throughout. Begin with a business objective and supplier dependency. A later relationship disclosure becomes a restricted compliance case, a control question and an audit procedure. A balanced ledger is not proof of an effective control; an owner reply is not verified closure.

## Before you start

Complete the Core company and authority lessons. Your operator installs the available GRC Product through Account and assigns the required company roles and object scope. A site administrator is not automatically a risk owner or auditor. In this combined course, Accounting evidence is available only through the approved mandate and supported source route; purchasing GRC does not grant unrestricted financial or payroll access.

The articles describe a training case to prepare with fictional data. They do not create records or assert that every lesson is already seeded in the public demo. Supported actions depend on the accepted Product release and published company process. Follow the indicated role, prerequisite, action and saved result in each lesson.

## Follow the learning path

| Step | Functional lesson | Result to retain |
| --- | --- | --- |
| 1 | [Identify a risk](/ja/learn/grc-risk-identification) | Objective, cause/event/consequence, owner and evidence. |
| 2 | [Approve a method and assess](/ja/learn/grc-risk-assessment) | Reviewed method, inputs and accepted assessment. |
| 3 | [Treat and verify](/ja/learn/grc-risk-response) | Approved plan, execution evidence and independent acceptance. |
| 4 | [Investigate a disclosure](/ja/learn/grc-compliance-case) | Restricted case, reasoned decision and corrective work. |
| 5 | [Build the risk-control matrix](/ja/learn/grc-control-matrix) | Published process/control revision with owners and sources. |
| 6 | [Test the control](/ja/learn/grc-control-testing) | Scoped design and operating conclusions, exception and follow-up. |
| 7 | [Issue an audit report](/ja/learn/grc-audit) | Reviewed procedure, finding, recommendation and issued revision. |
| 8 | [Monitor and reassess](/ja/learn/grc-monitoring) | Indicator history, approved review and separate actual-loss evidence. |

## Set up and apply risk assessment methods

The [assessment lesson](/ja/learn/grc-risk-assessment) starts with the approved method and ends with the independently accepted result. It does not infer a score from a financial amount. Budgets and financial sources provide governed context through the Suite's supported shared capabilities.

## Personal practice and videos

The existing [practice library](/ja/learn/grc-practice) retains its 40 interactive lessons, additional workshops and prepared-video status. Open the installed Railbase **Help · Tutorials** library for exercises available to your role. Practice answers are personal learning state; they do not create live risks, cases, payments or approvals. Prepared local recordings are not presented as published videos.

After the course, use the library to practise additional methods, indicators, loss reconciliation, controls and assurance work. Check [Product availability](/ja/learn/product-availability) for the actual supported release.