Question 1

How is RiskBridge different from using a Gartner or Forrester report?

Accepted Answer

Analyst quadrants rank vendors by analyst opinion and vendor-reported capabilities, not your specific organizational context. RiskBridge applies a five-domain scoring model calibrated to your exact requirements: your industry, regulatory profile, commercial constraints, data residency needs, and technical ecosystem. A vendor ranked Leader in a Gartner MQ can score "0" in our engine if it fails your hard filters on data residency or module coverage.

Question 2

How many GRC tools do you have in your database?

Accepted Answer

We actively maintain profiles for 200+ GRC tools, spanning Enterprise Risk, Compliance, Internal Audit, Privacy, Vendor Risk, Cyber, IT Risk, and Incident Management capabilities. The database includes Gartner MQ and Forrester Wave tracked vendors, as well as specialized tools not covered by mainstream analyst research. All profiles are subject to ongoing practitioner validation.

Question 3

Does RiskBridge take commissions from vendors?

Accepted Answer

No. We have no commercial relationships with any vendor in our database. No referral fees, no preferred partner agreements, no sponsorships. Our practitioners are engaged exclusively on the client side. This is non-negotiable.

Question 4

What are the 12 stages of your implementation framework?

Accepted Answer

The 12 stages span four phases: Foundation (Mobilisation, Current State Analysis, Future State Design), Build (Technical Configuration, Data Migration, Integration Development), Validate (Quality Assurance, UAT, Training), and Operationalise (Controlled Go-Live, Hypercare, Handover & Continuous Improvement). Every stage requires documented evidence before advancement - this is enforced through a four-point stage-gate control.

Question 5

What is a "stage-gate" and why is it important?

Accepted Answer

A stage-gate is a formal checkpoint that requires documented Entry Criteria, Exit Criteria, signed Evidence, and Sign-off Authority before a project can proceed to the next stage. Without stage-gates, implementation teams declare stages "complete" based on assumptions rather than verified evidence. This is the single most common root cause of post-go-live implementation failure.

Question 6

What is the GRC Health Score and how is it calculated?

Accepted Answer

The Health Score is a 0–100 measure of your GRC platform's operational effectiveness, calibrated across five core domains. It is calculated by triangulating data from up to 7 sources: an internal self-assessment questionnaire, live system telemetry data points (SD-01 to SD-20), an anonymous user survey, role-specific stakeholder questionnaires, live process walkthrough checklists, a tool deep-dive capability assessment, and value realisation interviews. Each source is weighted by its confidence level (Low/Medium/High) based on alignment standard deviation.

Question 7

What are "Value Killers" (VK-01 to VK-12)?

Accepted Answer

Value Killers are 12 identified anti-patterns that systematically destroy GRC platform ROI. Examples include overcomplicated user-facing workflows (VK-02), broken automated alert chains (VK-05), dormant licensed modules generating cost without value (VK-07), and user survey feedback that is collected but never acted upon (VK-11). Our assessment engine automatically detects Value Killers from the triangulated source data and routes them to the Optimise roadmap.

Question 8

What is meant by "dormant module cost"?

Accepted Answer

Dormant module cost is the annualized financial value of licensed GRC platform capabilities that are not actively being used. If your organization pays for an enterprise risk module, a vendor risk module, and a compliance module, but only the risk module is actively populated, the compliance and VRM modules are generating dormant cost. We calculate this by cross-referencing your annual licence cost against your active vs. dormant module utilization percentage.

Question 9

How long does it take to move from "Poor" to "Good" on the Health Score?

Accepted Answer

Based on practitioner experience across our delivered programs, organizations that commit to the 90-day Quick Win roadmap typically move 12–18 points in the first quarter. The 6-month Structural tier typically delivers an additional 10–15 points. Moving from the "Poor" band (31–50) to the "Good" band (66–80) typically requires a sustained 9–12 month improvement program, depending on the severity of detected Value Killers and organizational change capacity.

Question 10

Is RiskBridge a SaaS platform or a consulting firm?

Accepted Answer

RiskBridge is a practitioner-led advisory platform. The Product Selector is a tool-assisted service, not a self-serve SaaS. Every engagement involves GRC practitioners with direct implementation experience. We use technology to scale practitioner intelligence, not to replace it.

Question 11

Where is my data hosted?

Accepted Answer

All data is hosted exclusively in Australia. We do not replicate or transfer organizational data to offshore infrastructure. Our hosting environment operates under ISO/IEC 27001:2022 certified information security controls and is designed for APRA CPS 234 compliance.

Frequently Asked Questions.