SmartHubs Documentation
MicroGRC (Enterprise Risk & Controls)
Comprehensive guide to SmartHubs' lightweight risk and controls management solution.
Last updated: February 2026
What is MicroGRC?
MicroGRC is a lightweight enterprise risk and controls management solution designed to complement internal audit activities. It helps organizations:
- Identify and assess organizational risks
- Map risks to business objectives
- Document control activities and ownership
- Assess control effectiveness and maturity
- Link controls to audit procedures
- Monitor risk mitigation actions
- Generate risk and control assessment reports
Key Features
Risk Identification & Assessment
Systematically identify and assess organizational risks.
- Risk identification workshops and templates
- Risk categorization (strategic, operational, compliance, financial)
- Impact and probability assessment
- Risk rating and materiality
- Risk owner assignment
- Risk trend tracking
Business Objective Mapping
Map risks to business objectives for strategic alignment.
- Define organizational objectives
- Link risks to business goals
- Assess risk impact on objectives
- Prioritize risks by business importance
- Track objective achievement
Control Design & Documentation
Document control activities that mitigate identified risks.
- Control design documentation
- Control objectives and activities
- Responsibility and frequency definition
- Key controls identification
- Supporting process documentation
- Control change management
Risk-Control Linkage
Connect controls to the risks they mitigate.
- Map controls to identified risks
- View controls by risk
- Identify gaps and overlaps
- Redundancy analysis
- Control adequacy assessment
Control Testing & Effectiveness
Assess and document control effectiveness.
- Annual control effectiveness assessment
- Testing procedures and results
- Control maturity rating
- Operating effectiveness documentation
- Control improvement tracking
Audit Linking & Planning
Integrate with MicroAudit for coordinated audit planning.
- Link controls to audit procedures
- Risk-based audit planning support
- Control testing evidence collection
- Audit universe development
- Integrated planning view
Risk Management & Control Lifecycle
Phase 1: Risk Identification & Assessment
Activities:
- Identify organizational risks across all categories
- Assess risk impact and probability
- Rate and prioritize risks
- Assign risk owners
- Document risk drivers and context
- Map risks to business objectives
Typical Frequency: Annually, with quarterly reviews
Phase 2: Control Design & Documentation
Activities:
- Define control objectives for key risks
- Design control activities
- Document control procedures
- Assign responsibility and timing
- Map controls to risks
- Identify key controls for testing
Typical Frequency: Annually, with updates as needed
Phase 3: Control Assessment & Testing
Activities:
- Conduct control effectiveness assessments
- Test operating control effectiveness
- Rate control maturity level
- Document assessment results and evidence
- Identify control gaps or weaknesses
- Report control status
Typical Frequency: Annually
Phase 4: Monitoring & Improvement
Activities:
- Monitor ongoing control performance
- Track control improvement actions
- Document remediation efforts
- Update risk assessment as needed
- Review emerging risks
- Prepare management reports
Typical Frequency: Quarterly or more frequently as needed
Best Practices for MicroGRC
Strategic Alignment
Tie risk and control management to organizational objectives for strategic relevance.
Proportionate Approach
Focus on material risks and key controls—avoid over-documentation.
Regular Assessment
Conduct formal risk and control assessments at least annually with ongoing monitoring.
Cross-Functional Engagement
Involve business process owners in risk identification and control design.
Audit Integration
Use risk and control information to inform audit planning and scope.
Integration with MicroAudit
MicroGRC and MicroAudit work together to create a holistic governance framework:
- Risk-Based Planning: Use risk assessment to plan audits focused on high-risk areas
- Procedure Development: Link audit procedures to documented controls
- Evidence Alignment: Collect evidence of control effectiveness during audits
- Finding Management: Connect audit findings to control weaknesses
- Integrated Reporting: Report on risks, controls, and audit findings together
Need help? Contact our support team