Lab 01 — Build GRC Dashboard

Modern GRC teams manage large amounts of information across:

Risk Registers

Control Libraries

Compliance Assessments

Internal Audits

Third-Party Assessments

Policy Exceptions

Security Findings

Remediation Plans

Continuous Compliance Monitoring

Raw GRC data alone does not help leadership make decisions.

In this lab, you will transform operational GRC data into an enterprise GRC dashboard that provides meaningful visibility into:

Enterprise Risk
      ↓
Risk Appetite
      ↓
Control Health
      ↓
Compliance
      ↓
Audit Findings
      ↓
Third-Party Risk
      ↓
Remediation
      ↓
Executive Decisions

This lab simulates work commonly performed by:

• GRC Analysts

• Cyber Risk Analysts

• Compliance Analysts

• Risk Managers

• Security Governance Analysts

• Internal Audit teams

• GRC Platform Administrators

Mission Information

Field	Details
Lab Type	GRC Dashboard & Reporting
Primary Role	GRC Analyst
Supporting Roles	Risk Manager, Compliance Manager, Internal Audit, Security Governance
Difficulty	Intermediate
Estimated Time	90–120 minutes
Environment	Spreadsheet / GRC Platform Simulation
Primary Deliverable	Enterprise GRC Dashboard
Secondary Deliverables	Risk Register, Control Dashboard, Compliance Scorecard, Findings Tracker
Skills Practiced	Risk Reporting, KRIs, KCIs, Compliance Metrics, Executive Reporting

Mission Scenario

You are working as a GRC Analyst at Meridian Digital Services.

Meridian operates:

Cloud Infrastructure

Customer SaaS Platforms

Corporate IT

Payment Processing

Third-Party SaaS Services

Remote Workforce

The organization maintains several compliance obligations, including:

ISO 27001

SOC 2

PCI DSS

Privacy Requirements

Internal Security Policies

Management currently receives separate spreadsheets from:

Risk Management

Cybersecurity

Compliance

Internal Audit

Vendor Risk

IT Operations

Leadership has identified a major problem.

There is no consolidated view showing:

Top Risks

Risk Appetite Breaches

Control Failures

Compliance Gaps

Audit Findings

Vendor Risk

Overdue Remediation

Your mission is to design an Enterprise GRC Dashboard.

Lab Objectives

By completing this lab, you will:

1. Build a basic enterprise risk register.

2. calculate inherent and residual risk.

3. identify risk appetite breaches.

4. create a risk heat map.

5. build control-health metrics.

6. create compliance scorecards.

7. analyze audit findings.

8. monitor finding aging.

9. analyze third-party risk.

10. define KRIs and KCIs.

11. build remediation metrics.

12. create executive-level GRC indicators.

13. design an actionable enterprise GRC dashboard.

Lab Architecture

You will build the following reporting model:

                    ENTERPRISE GRC
                         │
          ┌──────────────┼──────────────┐
          │              │              │
        Risks         Controls      Compliance
          │              │              │
          ├──────────────┼──────────────┤
          │              │              │
        Audit          Vendors       Findings
          │              │              │
          └──────────────┼──────────────┘
                         │
                    Remediation
                         │
                         ↓
                 Executive Dashboard

Part 1 — Prepare Your Workspace

You may perform this lab using:

Microsoft Excel

Google Sheets

LibreOffice Calc

GRC Platform Sandbox

Spreadsheet Application

For the lab, a spreadsheet is sufficient.

Create a workbook named:

Enterprise-GRC-Dashboard.xlsx

Create the following worksheets:

01 Executive Dashboard

02 Risk Register

03 Controls

04 Compliance

05 Audit Findings

06 Third-Party Risk

07 Remediation

08 Metrics

Part 2 — Build the Risk Register

Open:

02 Risk Register

Create the following columns:

Field	Purpose
Risk ID	Unique identifier
Risk	Risk scenario
Category	Risk domain
Owner	Accountable owner
Likelihood	1–5
Impact	1–5
Inherent Risk	Likelihood × Impact
Control Effectiveness	Effective / Partial / Weak
Residual Likelihood	1–5
Residual Impact	1–5
Residual Risk	Residual Likelihood × Residual Impact
Risk Appetite	Maximum acceptable risk
Status	Within / Breach
Trend	Increasing / Stable / Decreasing
Treatment	Mitigate / Accept / Transfer / Avoid

Part 3 — Populate Enterprise Risks

Add the following scenarios.

ID	Risk	Category
R-001	Ransomware disrupts critical business services	Cybersecurity
R-002	Cloud configuration exposes customer information	Cloud
R-003	Critical vendor suffers security breach	Third Party
R-004	Privileged account compromise	Identity
R-005	Payment environment fails PCI requirements	Compliance
R-006	Personal information processed unlawfully	Privacy
R-007	Critical systems cannot recover within RTO	Resilience
R-008	Critical vulnerabilities remain unpatched	Vulnerability

Assign appropriate owners.

Example:

R-001 → CISO

R-002 → Cloud Security Manager

R-003 → Third-Party Risk Manager

R-004 → IAM Manager

R-005 → Compliance Manager

R-006 → Privacy Officer

R-007 → IT Operations Manager

R-008 → Vulnerability Management Lead

Part 4 — Calculate Inherent Risk

Use:

Inherent Risk
=
Likelihood × Impact

Example:

Likelihood = 5

Impact = 5

Risk Score = 25

Use this scoring model:

Score	Rating
1–4	Low
5–9	Medium
10–16	High
17–25	Critical

Example:

Ransomware

Likelihood = 5

Impact = 5

Inherent Risk = 25

Rating = Critical

Part 5 — Calculate Residual Risk

Residual risk represents exposure after considering controls.

Example:

Ransomware

Inherent Risk
5 × 5 = 25

Controls:

EDR
Backups
MFA
Network Segmentation
Security Monitoring

Residual Likelihood = 3
Residual Impact = 5

Residual Risk
3 × 5 = 15

Therefore:

Inherent Risk = 25

Residual Risk = 15

Part 6 — Add Risk Appetite

Add an approved risk appetite value for every risk.

Example:

Risk	Residual Risk	Appetite
Ransomware	15	10
Cloud Exposure	12	9
Vendor Breach	12	10
Privileged Compromise	15	8
PCI Failure	10	8

Determine:

IF Residual Risk > Risk Appetite

THEN

Risk Appetite Breach

Otherwise:

Within Appetite

Part 7 — Identify Appetite Breaches

Your dashboard should clearly identify risks such as:

R-001

Residual Risk = 15
Appetite = 10

BREACH

and:

R-004

Residual Risk = 15
Appetite = 8

BREACH

Create a metric:

Risk Appetite Breaches

Part 8 — Add Risk Trends

For each risk assign:

↑ Increasing

→ Stable

↓ Decreasing

Example:

Risk	Residual Risk	Trend
Ransomware	15	↑
Cloud Exposure	12	→
Vendor Breach	12	↑
Privileged Compromise	15	→
PCI Failure	10	↓

This helps management understand not only:

Where Are We?

but:

Where Are We Going?

Part 9 — Build the Risk Heat Map

Create a:

5 × 5

risk matrix.

Structure:

                 IMPACT

             1   2   3   4   5

Likelihood 5  M   H   H   C   C
           4  M   M   H   H   C
           3  L   M   M   H   H
           2  L   L   M   M   H
           1  L   L   L   M   M

Plot each enterprise risk according to:

Residual Likelihood

Residual Impact

Example:

R-001
Likelihood = 3
Impact = 5

Place:

R-001

at:

Likelihood 3
Impact 5

Part 10 — Build the Control Register

Open:

03 Controls

Create:

Control ID	Control	Domain	Owner	Status	KCI	Target	Current
IAM-001	Privileged MFA	Identity	IAM	Effective	MFA Coverage	100%	98%
VM-001	Vulnerability Remediation	Security	VM Team	Partial	Critical SLA	100%	92%
LOG-001	Centralized Logging	Security	SOC	Effective	Logging Coverage	100%	99%
ENC-001	Data Encryption	Security	Cloud	Effective	Encryption Coverage	100%	100%
BCP-001	Backup & Recovery	Resilience	IT Ops	Partial	Recovery Tests	100%	90%
IAM-002	Access Reviews	Identity	IAM	Weak	Review Completion	100%	75%

Part 11 — Determine Control Health

Use:

Healthy

Degraded

Failed

Example:

Privileged MFA

Target:
100%

Current:
98%

Status:
Degraded

Access Reviews:

Target:
100%

Current:
75%

Status:
Failed

Part 12 — Create Control Metrics

Calculate:

Total Controls

Healthy Controls

Degraded Controls

Failed Controls

Example:

Total Controls        6

Healthy               2

Degraded              3

Failed                1

Part 13 — Build the Compliance Scorecard

Open:

04 Compliance

Create:

Framework	Applicable Controls	Passing	Failing	Missing Evidence
ISO 27001	80	76	4	3
SOC 2	55	53	2	2
PCI DSS	60	56	4	5

Calculate:

Compliance %
=
Passing Controls
÷
Applicable Controls
×
100

Example:

PCI DSS

56 ÷ 60 × 100

= 93.3%

Part 14 — Add Compliance Exceptions

Add:

Active Exceptions

Expired Exceptions

Evidence Stale

Assessments Overdue

Example:

Framework	Active Exceptions	Expired	Stale Evidence
ISO 27001	3	0	2
SOC 2	2	1	3
PCI DSS	5	1	4

Part 15 — Build the Audit Findings Register

Open:

05 Audit Findings

Create:

Finding ID	Finding	Severity	Owner	Open Date	Due Date	Status
F-001	MFA missing for privileged accounts	Critical	IAM	01-Jan	15-Jan	Open
F-002	Vulnerabilities past SLA	High	Security	05-Jan	05-Feb	Open
F-003	Access review incomplete	High	IAM	10-Jan	10-Feb	Open
F-004	Backup recovery testing incomplete	Medium	IT Ops	15-Jan	15-Mar	Open
F-005	Vendor assessment overdue	High	TPRM	20-Jan	20-Feb	Open

Part 16 — Calculate Finding Aging

Use:

Finding Age
=
Current Date
-
Open Date

Create aging buckets:

0–30 Days

31–60 Days

61–90 Days

91–180 Days

180+ Days

Part 17 — Identify Overdue Findings

Use:

IF

Current Date > Due Date

AND

Status ≠ Closed

THEN

Overdue

Track:

Critical Overdue

High Overdue

Medium Overdue

Part 18 — Track Repeat Findings

Add:

Repeat Finding?

Values:

Yes

No

Repeat findings should receive special attention because they may indicate:

Weak Remediation

Poor Root Cause Analysis

Governance Failure

Management Inattention

Part 19 — Build the Third-Party Risk Register

Open:

06 Third-Party Risk

Create:

Vendor	Criticality	Inherent Risk	Residual Risk	Assessment	Findings
Cloud Provider A	Critical	20	10	Complete	1
Payment Provider B	Critical	25	15	Complete	4
SaaS Provider C	High	16	8	Overdue	2
Marketing Vendor D	Medium	9	4	Complete	0
HR Platform E	High	16	10	Due	1

Part 20 — Vendor Metrics

Calculate:

Total Vendors

Critical Vendors

High-Risk Vendors

Assessments Overdue

Open Critical Findings

Part 21 — Vendor Risk Escalation

Flag vendors where:

Criticality = Critical

and:

Residual Risk ≥ High

Example:

Payment Provider B

Critical Vendor
+
Residual Risk = 15
+
4 Findings

This should appear prominently on the dashboard.

Part 22 — Build the Remediation Register

Open:

07 Remediation

Create:

Action ID	Source	Severity	Owner	Due Date	Status	Validation
A-001	F-001	Critical	IAM	15-Jan	In Progress	Pending
A-002	F-002	High	Security	05-Feb	In Progress	Pending
A-003	F-003	High	IAM	10-Feb	Blocked	Pending
A-004	F-004	Medium	IT Ops	15-Mar	Complete	Validated
A-005	Vendor B	High	TPRM	28-Feb	In Progress	Pending

Part 23 — Remediation Metrics

Calculate:

Total Actions

Open Actions

Completed Actions

Overdue Actions

Blocked Actions

Critical Overdue Actions

Part 24 — Create the Metrics Catalogue

Open:

08 Metrics

Create:

Metric	Type	Target	Source	Owner
Risk Appetite Breaches	KRI	0	Risk Register	CRO
Critical Findings Past SLA	KRI	0	Audit	GRC
Privileged MFA Coverage	KCI	100%	IAM	IAM
Vulnerability SLA Compliance	KCI	100%	Scanner	Security
Assessments Completed	KPI	100%	GRC	Compliance
Vendor Assessments Overdue	KRI	0	TPRM	TPRM

Part 25 — Define Thresholds

For:

Privileged Accounts Without MFA

define:

0
=
Normal

1
=
Warning

>1
=
Critical

For:

Critical Findings Past SLA

define:

0
=
Normal

1
=
Warning

>1
=
Critical

Part 26 — Build the Executive Dashboard

Open:

01 Executive Dashboard

Create the following sections.

Section A — Enterprise Risk

Display:

Critical Risks

High Risks

Risk Appetite Breaches

Risks Increasing

Example:

Critical Risks              3

High Risks                  5

Risk Appetite Breaches      4

Risks Increasing            3

Part 27 — Control Health

Display:

Healthy Controls

Degraded Controls

Failed Controls

Example:

Control Health

Healthy        65%

Degraded       25%

Failed         10%

Part 28 — Compliance Status

Display:

ISO 27001

SOC 2

PCI DSS

Example:

ISO 27001       95%

SOC 2           96%

PCI DSS         93%

Do not treat these percentages as risk ratings.

Part 29 — Audit & Findings

Display:

Critical Findings

High Findings

Overdue Findings

Repeat Findings

Part 30 — Third-Party Risk

Display:

Critical Vendors

High-Risk Vendors

Overdue Assessments

Critical Vendor Findings

Part 31 — Remediation

Display:

Open Actions

Overdue Actions

Blocked Actions

Critical Overdue

Part 32 — Add Top Enterprise Risks

Create:

Risk	Residual	Trend	Appetite	Owner
Ransomware	15	↑	Breach	CISO
Privileged Compromise	15	→	Breach	IAM
Vendor Breach	12	↑	Breach	TPRM
Cloud Exposure	12	→	Breach	Cloud

Part 33 — Add Management Attention

Create a section named:

Management Attention Required

Example:

1. Privileged MFA below target

2. Critical ransomware risk above appetite

3. Payment provider residual risk remains High

4. PCI DSS remediation overdue

5. Access review control failed

This is one of the most important dashboard sections.

Part 34 — Build the Dashboard Layout

A possible design:

┌───────────────────────────────────────────────────────┐
│             ENTERPRISE GRC DASHBOARD                  │
├─────────────┬─────────────┬─────────────┬─────────────┤
│ Critical    │ Appetite    │ Critical    │ High-Risk   │
│ Risks       │ Breaches    │ Findings    │ Vendors     │
│     3       │     4       │     2       │     7       │
├─────────────┴─────────────┴─────────────┴─────────────┤
│                                                       │
│                    RISK HEAT MAP                      │
│                                                       │
├──────────────────────────┬────────────────────────────┤
│ CONTROL HEALTH           │ COMPLIANCE                 │
│                          │                            │
│ Healthy       65%        │ ISO 27001      95%        │
│ Degraded      25%        │ SOC 2          96%        │
│ Failed        10%        │ PCI DSS        93%        │
├──────────────────────────┼────────────────────────────┤
│ AUDIT FINDINGS           │ THIRD-PARTY RISK           │
│                          │                            │
│ Critical       2         │ High Risk        7        │
│ High           8         │ Overdue          5        │
│ Overdue        4         │ Critical Issues  3        │
├──────────────────────────┴────────────────────────────┤
│ MANAGEMENT ATTENTION REQUIRED                        │
│                                                       │
│ • Privileged MFA below target                        │
│ • Ransomware risk above appetite                     │
│ • Payment provider remediation overdue               │
└───────────────────────────────────────────────────────┘

Part 35 — Add Risk Trend Visualization

Create a chart using:

Month

Critical Risks

High Risks

Example dataset:

Month	Critical	High
Jan	2	8
Feb	2	7
Mar	3	7
Apr	3	6
May	4	5

Ask:

Is enterprise risk improving or deteriorating?

Part 36 — Add Findings Aging

Create:

Aging	Findings
0–30	20
31–60	14
61–90	8
91–180	5
180+	3

Your dashboard should make:

180+ Day Findings

easy to identify.

Part 37 — Add Compliance Trend

Create:

Month	Compliance
Jan	89%
Feb	91%
Mar	94%
Apr	96%
May	95%

Ask:

Why Did Compliance
Drop in May?

The dashboard should encourage investigation rather than simply displaying numbers.

Part 38 — Add Drill-Down Logic

Design your dashboard so that users conceptually move from:

Executive Dashboard
      ↓
Risk
      ↓
Control
      ↓
Finding
      ↓
Remediation

Example:

Cyber Risk
      ↓
Identity Risk
      ↓
IAM-001
      ↓
MFA Coverage 98%
      ↓
2 Admin Accounts
Without MFA
      ↓
A-001 Remediation

Part 39 — Validate Dashboard Data

Before finalizing your dashboard, verify:

Are All Risks Owned?

Are Risk Scores Correct?

Are Appetite Breaches Correct?

Are Control Metrics Current?

Are Compliance Calculations Correct?

Are Findings Complete?

Are Due Dates Accurate?

Are Vendor Ratings Current?

Are Remediation Actions Linked?

Are Metrics Traceable?

Part 40 — Executive Review

Imagine presenting your dashboard to:

CEO

CRO

CISO

CIO

Compliance Officer

You have five minutes.

You should be able to explain:

Our Current Risk

What Changed

Where We Exceed Appetite

Where Controls Are Failing

What Compliance Gaps Matter

What Is Overdue

Who Owns Remediation

What Leadership Needs to Do

Final Dashboard Requirements

Your dashboard must include:

• enterprise risk summary.

• top risks.

• risk heat map.

• risk trends.

• risk appetite breaches.

• control-health summary.

• compliance scorecard.

• audit findings.

• finding aging.

• third-party risk.

• remediation status.

• KRIs.

• KCIs.

• management-attention section.

• clear ownership.

• actionable information.

Validation Checklist

Risk Management

• risk register completed.

• likelihood documented.

• impact documented.

• inherent risk calculated.

• residual risk calculated.

• appetite established.

• appetite breaches identified.

• trends assigned.

Controls

• controls documented.

• owners assigned.

• KCIs defined.

• targets defined.

• current values recorded.

• control health determined.

Compliance

• frameworks identified.

• applicable controls documented.

• passing controls recorded.

• failing controls recorded.

• evidence gaps recorded.

• compliance percentages calculated.

Audit

• findings documented.

• severity assigned.

• owners assigned.

• due dates recorded.

• aging calculated.

• overdue findings identified.

• repeat findings identified.

Third Party

• critical vendors identified.

• inherent risk assessed.

• residual risk assessed.

• assessments tracked.

• vendor findings monitored.

Remediation

• remediation actions documented.

• owners assigned.

• deadlines recorded.

• overdue actions identified.

• blocked actions identified.

• validation status tracked.

Dashboard

• executive metrics displayed.

• top risks displayed.

• trends displayed.

• material exceptions highlighted.

• management actions identified.

• dashboard data validated.

Lab Deliverables

At the end of this lab, you should have:

Enterprise-GRC-Dashboard.xlsx

containing:

01 Executive Dashboard

02 Risk Register

03 Controls

04 Compliance

05 Audit Findings

06 Third-Party Risk

07 Remediation

08 Metrics

Your portfolio deliverables should demonstrate:

Risk Register
      +
Risk Heat Map
      +
Control Health
      +
Compliance Scorecard
      +
Audit Dashboard
      +
Vendor Risk
      +
Remediation Tracking
      +
Executive Dashboard

Real-World Skills Developed

This lab develops practical skills in:

Enterprise Risk Reporting

GRC Analytics

Risk Appetite Monitoring

Control Monitoring

Compliance Reporting

Internal Audit Reporting

Third-Party Risk Reporting

Remediation Governance

KRI Development

KCI Development

Executive Communication

These skills are directly relevant to roles such as:

GRC Analyst

Cyber Risk Analyst

Compliance Analyst

Security Governance Analyst

Technology Risk Analyst

Third-Party Risk Analyst

GRC Consultant

Risk Manager

Lab Completion Questions

Before marking the lab complete, answer:

1. Which enterprise risks currently exceed risk appetite?

2. Which risk has the highest residual exposure?

3. Which risks are increasing?

4. Which controls are failing?

5. Which KCI is furthest from its target?

6. Which compliance framework has the largest gap?

7. Which evidence is missing or stale?

8. Which audit findings are overdue?

9. Are any findings repeated?

10. Which vendor represents the highest residual risk?

11. Which vendor assessments are overdue?

12. Which remediation actions are blocked?

13. Which critical actions are overdue?

14. What are the top three KRIs?

15. What are the top three KCIs?

16. Which issues require executive attention?

17. Who owns each major issue?

18. What should management prioritize first?

19. Is enterprise risk improving or deteriorating?

20. Can every dashboard metric be traced back to its source?

Lab Success Criteria

You have successfully completed the mission when you can move from:

Raw GRC Data

to:

Risk Information

and finally:

Management Decision

Your dashboard should allow a stakeholder to quickly answer:

What Is Our Risk?

What Is Getting Worse?

Where Are We
Outside Appetite?

Which Controls
Are Failing?

Where Are Our
Compliance Gaps?

What Is Overdue?

Who Owns It?

What Must
We Do Next?

That is the purpose of an enterprise GRC Dashboard.

What’s Next?

➡️ Next: Lab 02 — Automate Compliance Reporting

In the next lab, you will move beyond manually consolidating GRC information and build an automated compliance reporting workflow.

You will work through:

Compliance Data Sources
      ↓
Automated Data Collection
      ↓
Control Mapping
      ↓
Evidence Collection
      ↓
Compliance Evaluation
      ↓
Exception Detection
      ↓
Reporting
      ↓
Management Dashboard

The objective is to understand how modern GRC teams reduce repetitive manual compliance work while maintaining reliable, traceable, and audit-ready evidence.

➡️ Next: Lab 02 — Automate Compliance Reporting