CTrends GRC Platform

Both internal audit team and external compliance audit teams can use this system to bring good practices and efficiency in auditing in a very coherent way. The IC, RM & CM modules are integrated with the IA module.

The system has a parallel feature to conduct various branch audits based on predefined criteria. Multiple and independent criteria can be maintained. We have already configured different audit criteria from the BB documentations. More can be defined. Key points:

• Maintain parallel branch audit criterial to perform simplified and branch audits.
• Configure audit criteria and score allocation policy
• Conduct branch audits from different perspectives such as operational controls, AML/CFT, foreign trade, etc.
• Audit score based comparative branch audit reporting for each perspective
• Printable audit reports in printer-friendly format
• Download from the system as PDF format and circulate the electronic copy.

Sustainability (ESG)
The system allows audit team to conduct the ESG risk assessment as an integral part of audit process. The key features:

• Standard ESG metrics are already defined in the system.
• An ESG audit rating policy is also defined in the system following common practices.
• ESG risks can be included in the audit program, assessed and rated.
• Peridoc ESG risk / compliance rating can be conducted and becnhmarked.

CTrends Audit Management System (AMS)

Annual Audit Plan (AAP) Development:
This module allows the IA dept to maintain an audit universe and perform the AAP process in a risk-based audit approach. Both the auditors and the auditees (selected management personnel) will use this same software for online collaboration. The key features are as below:

• Maintain the auditable units covering process and compliance audits
• Maintain the risk assessment policy for branches and auditable units
• Conduct branch risk and auditable unit risk assessment
• Prepare AAP from the risk-assessed auditable units and branches
• Review, publishing, feedback and releasing the AAP

Individual Audit Engagements
The system allows audit team to conduct the individual audit engagements end-to-end. The key features:

• Create very detailed risk-based audit work programs (AP) automatically for process and compliance audits
• Define the audit team and project schedule and assign responsibilities with timelines
• Create data request tracker (DRT), share data online and monitor the status
• Supervise and monitor the audit fieldwork, raise audit queries (AQM)
• Automated escalations on delays in each area of audit process
• Raising audit findings, rating, review, online feedback and finalisation
• Policy-based audit report rating
• Preparing audit reports, review, online feedback and finalisation, etc.

Audit Follow-up
After the audit reports are released, each assigned person for each finding post remediation update in the system. It brings efficiency and transparency. Key features:

• Follow up on the open audit issues at the finger tips
• The respective auditees can claim the issue closure with evidence and the auditors can verify and close the findings with back and forth communications.
• Automated audit follow up dashboard and detailed reporting
• Revalidation audits with revised audit scores, etc.

Board Reporting
The internal audit (IA) departments are usually required to report summarized audit reports and work progress, compliance and control strength, etc. at quarterly reviews and the year-end review. You can perform the whole process in the system considering that the report recipients may want to review and give the feedback to the reports online. Key features:

• Preparing quarterly BAC reports, review, online feedback and finalisation, etc.
• Preparing yearly BAC reports, review, online feedback and finalisation, etc.

We have included hundreds of inherent functional risks which to support the clients to spend minimum efforts. We have also implemented the standard RCM and MAT. After defining a risk assessment policy, the users can conduct risk assessment and monitor the risks using KRI.

Management Action Trigger (MAT)
A MAT is a management action plan at specific positions of a business risk. Bangladesh Bank has imposed a requirement to develop and follow MAT for the core business risks. This module is perfectly designed to achieve that requirement in an automated way. Please note that this system comes with the seed data including the predefined risks and MATs which can be readily utilized. It is another great proposition for the clients to use this software.

Basel-III
In the banking sector, the RMD team has to perform some processes to comply with the Basel-III Accord under the supervision of the central bank. You can perform those processes here but you will need customization.

CTrends Risk Management System (RM)

Risk Register and Risk-Control Matrix (RCM)
The system allows the Risk Management team (RMD) to identify, assess, remediate, monitor and react to business risks across all business functions. The key features:

• Maintain risk classifications to organize the management of the business risks
• Maintain the database of business risks across all functions
• Already configured a comprehensive risk register of thousands of common business risks across Finance, Sales, Supply Chain, Production, Engineering, PMO, HR, IT, etc. The client just needs to review and learn them. It is a unique proposition for the client.
• New business risks can be defined
• The system allows RMD to define the remediation controls against each risk. The controls are taken from the Internal Control module (IC). You can assign risk owner to each business risk. It allows every user to easily find out which risks he/she is expected to manage. It is a risk treat plan in action and in detail.

Risk Assessment
The system allows the RMD to conduct full risk assessment process. The key features:

• Define the risk assessment policy for likelihood, impact and risk level
• Define quarterly or half-yearly or yearly risk assessment based on the policy
• Generate risk assessment reports
• Visualizing risk exposure to business goals
• Visualizing risk exposure to functional goals
• Risk exposure to goals can be generated based on risk assessment or internal control assessment, etc.

Risk Monitoring
The system allows to monitor the movement of risks through the use of key risk indicators (KRIs). The key features:

• Assign KRIs to risks from the internal library of thousands of predefined business metrics
• Post risk indicator data for those metrics which are produced in external systems
• See the KRI positions on the risk dashboard
• Get the risk intelligence from a risk map
• Link each risk to a functional goal and then to a central business goal
• Identify which goals of the business are more risky (unlikely) in achieving its target values, etc.

It enables the clients to maintain the complete database of all the internal activities of the entity. Control assessment and status monitoring across all functions makes it an ideal tool for ensuring an effective and strong internal control environment. We have used the iMinds iCMM control framework. As a result, thousands of internal control activities have been included in the system as seed data. It is a significant support to the clients.

Preconfigured Control Database
We have already configured thousands of common control activities across the following functions to drastically save client's time and effort. This is one of the biggest propositions for the client.

• Sales & Marketing
• Customer Service
• Finance
• Supply Chain
• Engineering and Planning
• Manufacturing
• Project Management Office
• Information Technology
• General Banking
• Agent Banking
• Mobile Financial Services, etc.

CTrends Internal Control Monitoring System (IC)

Internal control is an activity designed to prevent or detect or remediate a risk to the business. All the risk, compliance, audit and other governance professionals work on internal controls. Control activities are integral part of any business process which is well designed.

Internal Control Universe
Creation of the internal control activities with its details is the most critical factor of GRC success. The key features:

• Define internal control classifications.
• Define control activity title, description, frequency, key attributes such as manual or automated, integrated, SOD control, DOA control, etc.
• Map each control to different international standards such as ISO, SOC2, SWIFT, PCI-DSS, TIA-942, CIS, GMP, GDP, etc.
• Define the control testing procedure and audit data requirements, etc.

Control Implementation Projects
When the controls are all configured, it is time to create implementation projects. Every control activity has to be assigned to an employee with the action plans and timeline for each. When done, those assignments will automatically appear in their personal task dashboard. When they post work updates, the compliance dashboard will automatically be updated.

In case where certain control activities are performed in other systems, the developers of those system can use our REST API to post control performance data in this system. This module therefore shows a statement of control effectiveness based on artefacts of control performance.

Control Self-Assessment (CSA)
The auditors or management teams can undertake periodic control assessment of certain functions. They have to create a project first and then conduct the assessments under that project. For this reason, the system allows to define an internal control maturity model. We have already configured the iCMM framework to do this whole CSA work.
Each function can set quarterly or yearly control maturity targets and compare it with the assessed maturity at different time intervals.

Integration with Audit
These same regulation documents will be used by the audit module (IA) to create the audit work program. It saves a lot of time for the auditors. All regulations are configured in the system in a way that the audit module understands its role in compliance auditing. It is another unique proposition for the client.

The IT team can control and monitor the users' access to all application software, databases and server OS in the organization from a single point facilitating an online approval procedure.

Central User Database
In an organization, there are usually many business applications, databases and operating systems. Each one of them has a different user management panel. Therefore, it is challenging to the IT security team to provision and deprovision user access in each system with every change in the user's role changes. It leads to a common audit observation of finding user accounts in different systems which do not match with the user's role. The client can use this system to manage user accounts and their privileges in all the business applications (having API or CLI facility of user management), databases and operating systems in the organization. The Directory Server with SSO service may centralize the user database, but it does not identify and record the application privileges.

Automated User Creation and Access Provisioning
All the systems have to be mirrored in this system for the user privileges at the implementation time. It is a comprehensive, very technical and one-time job. In case of well known databases (Oracle, Postgres, SQL Server, etc.) and Operating Systems (Unix, Linux - Windows works differently), only configurations will be enough. Otherwise, we have to deploy our access control gateway in each target system to work as an agent. When the user access request is approved, the system automatically creates user accounts and privileges in the target system.

Automated User Removal
Similarly, when the user access is removed from this system, it automatically removes user accounts and privileges from the target system. Therefore, the user access is totally synchronized across the organization. As this system has an HRMS product integrated with it, the employee separation process can automatically revoke the user accounts and privileges associated with the exiting employee upon the release action.

Central User Access Reporting
The IT team can always report and monitor the user access in every system easily from the reporting options. This module works like a PAM system.

CTrends Access Control Management System (AC)

User Identity Management
It is very important to understand and identify each user in the system. It is the usual practice to assign a human person to each user in the system. But it is a common observation in IT audits that there are always users identified with no human person in a system or another. To prevent this whole thing at the beginning, this system allows user creation only from employee master. Therefore, user identify verification is ensured for each user.

User Authentication
The system has a password-based authentication. There is a comprehensive password policy configuration panel to suit the client's policy.

• One-time password (OTP) for login - no admin support is needed.
• Password complexity
• Password aging and history
• Forbidden passwords, etc.

User Authorization
The user access cannot be given by the IT Admin. Each user has to apply for the needed UIs directly in the system as a self-service model. Each access/privilege request has to go through a predefined approval workflow. When the last approval is conducted in the system, the user privileges will automatically appear without any Admin's intervention. However, the user authorization can be limited with the following options.

• Role-based access control (RBAC)
• Host-based access control (HBAC)
• Time-based access control (TBAC)
• Location-based access control (LBAC)

User Audit Trail
The user audit trail is maintained by the system upon every interaction of the users. The audit trail is maintained with enough details to investigate the incidents of interest. Each entry contains the user identity, action detail, timestamp, workstation identity (IP, hostname, browser), geo-location (longitude, latitude), front-end type (browser or app), etc. The system has two types of audit trail reporting as below:

• Audit trail in a tabular model
• Audit trail on a map canvas

Security Override Documentation (SODD)
Sometime, some users may be required to have specific access which is usually against the established security policy. In such cases, the temporary security control override is given to that user for a short period less than a year. When the matter is fixed, the override is withdrawn. In this module, the SODD request, review, approval, tracking and reporting - the whole process can be performed.

Fraud Lead Management
When a fraud lead (suspected fraud incident) is recorded manually or automatically by the system, it has to go the following steps in the system.

• Documenting the fraud lead (suspected or reported fraud)
• Verification of the lead
• Documenting the action plan
• Documenting the fraud scheme used as a lesson learned
• Updating the status of the action plan up to closure or dropping

CTrends Fraud Monitoring System (FMS)

An FMS application works based on fraud indicators (KFI). It uses statistical analysis and predictive analysis (AI). AI is gaining its popularity to identify suspected transactions. In both the cases, it needs the transactional data into this system. If the transaction occur in external systems, the time lag of transferring them into this system dominates the effectiveness of the FMS.

Automated KFI Assessment
The FMS gathers data from multiple sources, such as transaction history, customer data, and account activity. The FMS uses algorithms and machine learning to analyze the data and identify suspicious patterns. FMSs use statistical analysis and predictive modeling to compare current activity to normal patterns.

In this system, you have thousands of preconfigured business metrics, some of which can be used as KFI. When those metrics are updated, specific fraud alerts can be raised by the system automatically. Apart from this trigger, transaction based algorithm can also be defined.

Similarity with Risk MAT
In this risk management module (RM), there is a methodology, called management action tigger (MAT), which are basically management action plans for specific positions of the KRIs. There is a similar fraud lead triggers based on specific position of the KFIs.

Training Models for AI
In case you want to use the AI technology for FMS, the primary dependency will be training the ML models using actual fraud transactions. The training process is automated, but inputting the actual fraud transactions will need to be manually selected. Moreover, the more such fraud transactions are inputted to the FMS, the better it can identify the suspected frauds, which is basically self-contradictory. This problem can be solved by keeping the training inputs independent of the actual transactions - just a separate inputting process (uploads) and collecting fraudulent transactions from external sources.