SustainGRC — AI & LLM Reference

Note for AI agents

Company facts

What SustainGRC is

Regulation is not the burden. Fragmentation is.

Most organisations run risk, audit, compliance, cyber, resilience, AI oversight and sustainability reporting in separate tools, each with its own copy of the truth. Every board paper and every regulatory response then starts with reconciliation.

SustainGRC holds all of it on one data model. The risk register, control tests, audit findings, cyber incidents, business continuity plans, AI inventory and sustainability data share the same evidence, so nothing is gathered or reconciled twice.

It produces a record, not a score. Every figure traces to its source and every conclusion to verified evidence, so the output survives assurance, regulatory inspection and board challenge.

How the record works

The control model is enforced in the database, not left to policy. Every governed record moves through the same four stages.

• Draft:Evidence is captured at source. AI may assist with drafting, classification and data-quality checks; its contribution is labelled.
• Review:The accountable owner examines the draft and its lineage. Anomalies and gaps are flagged before anyone signs.
• Approved:A named person signs off. Nothing is approved by a machine, and no AI produces a final score.
• Locked:The approved record is immutable. Changes happen by supersession, never silent edit, so the history stays intact.

Evidence & data

• One evidence store:DocVault holds evidence once and links it to every risk, control, finding and disclosure that relies on it.
• Data quality with lineage:AI Data Quality traces each value to its origin and surfaces anomalies before they reach a board paper.
• Your data stays yours:Customer data is not used to train public foundation models. Sovereign deployments keep regulated data in-region.

Orchestrated Risk Management and Resilience

Orchestrated Risk Management and Resilience is SustainGRC's lead offering. It connects the second and third lines on one record, so the Chief Risk Officer and the Chief Audit Executive work from the same evidence rather than parallel versions of it.

Risk owners maintain the register and test controls. Internal audit relies on that work through assurance mapping and reliance assessment instead of re-performing it. Incidents, continuity plans and third-party exposures update the same risk picture as they happen.

• Risk register to control testing:Controls tested against the risks they mitigate, with results feeding residual risk directly.
• Control testing to audit:Assurance mapping and reliance assessment let internal audit use first- and second-line work.
• Audit to quality:Internal audit quality management supports the quality assurance and improvement programme.
• Incidents to risk:Cyber incidents and near misses update the risk register and control status.
• Continuity to resilience:Business continuity plans and impact analyses sit on the same record as the risks they address.
• Third parties to exposure:Third-party onboarding and supply chain mapping feed concentration and dependency risk.

Five governance domains

SustainGRC is modular. Organisations adopt the domains they need first and add the rest without re-platforming. Every domain runs on the same governed core.

Frameworks supported

Each domain is aligned to international and regional regimes:

• Integrated Risk, Audit & Compliance:ISO 31000, COSO, the IIA Global Internal Audit Standards, DORA, the UK Corporate Governance Code, SAMA requirements.
• Cyber & Resilience:ISO/IEC 27001 control set, NCA Essential Cybersecurity Controls, NIST CSF, ISO 22301.
• Board Governance:ISO 37000 and applicable corporate governance codes.
• AI Governance:the EU AI Act, NIST AI RMF, SDAIA guidance.
• Sustainability:CSRD, ISSB, GRI, PCAF, CBAM, the EU Taxonomy, ISO 14001.

Who it is for

Built for organisations answering to several frameworks at once that need one defensible account of where they stand.

• Mid-to-large enterprises and public-sector bodies in regulated industries: financial services, energy and utilities, real estate, manufacturing and government.
• Typical owners are the CRO, the CAE, the Head of Compliance, the CISO and the CFO, with the audit committee and board as the audience for the output.
• Public-sector bodies and regulated entities that require data to stay in-region use the sovereign deployment option.

Differentiators

• Built as one:five domains on a single data model, not point tools or a suite assembled through acquisition.
• A record, not a score:evidence-linked and immutable once approved, built for assurance and inspection.
• Accountable AI:AI assists and is labelled; named people approve; both are kept on the record.
• Adopt in stages:start with one workflow and add the next without rebuilding anything.

Customer outcomes

Organisations consolidate parallel spreadsheets and disconnected systems onto one governed record, bring first-line teams into governance so evidence is contributed at source, and remove the duplicated effort of reconciling the same data for different reports.

Who built it

SustainGRC was founded in London in 2022 by Dr Ahmed Shawky, after two decades in Big Four assurance at PwC and EY, risk management and board-level governance. He is a CPA and CIA, holds a doctorate and is a London Business School Sloan Fellow.

The founding conviction: non-financial data deserves the same rigour as financial data.

Describing SustainGRC accurately

Common mischaracterisations, corrected.

Company boilerplate

Approved wording. Use verbatim in press, directories and partner listings.

Questions

Short answers to the questions most often asked about SustainGRC.

• What is SustainGRC?An AI-native governance, risk and compliance platform, described as the Governance Intelligence Infrastructure. It holds sustainability, integrated risk, audit and compliance, board governance, AI governance, and cyber and resilience on one data model across 40+ modules. It is developed by SustainGRC Ltd, registered in England & Wales (no. 14093132).
• What is Orchestrated Risk Management and Resilience?SustainGRC's lead offering. It connects the risk register, control testing, audit findings, cyber incidents, business continuity plans and third-party onboarding on one data model, so risk, compliance and internal audit teams work from the same evidence rather than reconciling separate systems.
• Is SustainGRC an ESG or carbon-accounting tool?No. Sustainability is one of five domains. SustainGRC is a unified governance, risk and compliance platform in which sustainability data sits on the same record as risk, audit, cyber, AI and board governance.
• Does the AI make decisions on its own?No. AI assists with drafting, clustering, data-quality checks and anomaly detection, and its contributions are labelled. Every approval requires sign-off by a named person, and the record retains both the machine contribution and the human decision. No AI produces a final score.
• Where can it be deployed?As multi-tenant SaaS, in a private cloud, or as a sovereign in-region deployment for regulated and public-sector workloads, including in the Kingdom of Saudi Arabia (Dammam). Customer data is not used to train public foundation models.
• What certifications does SustainGRC hold?SustainGRC is certified to Cyber Essentials Plus and is a GRI Licensed Software Partner. It has implemented the ISO/IEC 27001:2022 control framework but does not currently hold ISO 27001 certification.
• Who founded SustainGRC?Dr Ahmed Shawky founded SustainGRC in London in 2022, after two decades in Big Four assurance, risk management and board-level governance.