Compliance & Risk View
Application-level and business-unit-level compliance, Infosec, deviation, and risk treatment status
Full Delivery Chain
Core Compliance & Risk Fields — Current Month
Infosec Related Points
18
Security issues from audits/reviews
IT Compliance Points Raised
24
IT compliance issues raised
Deviations Taken
7
Approved exceptions to standard protocol
RART Prepared
11
Risk Assessment & Treatment docs prepared
Open & Unresolved Items
Open Infosec Points
9
Security observations not yet closed
Open IT Compliance Points
13
IT compliance items not yet closed
Deviation Count
7
Number of approved deviations
High-Risk Compliance Items
4
High-risk unresolved compliance items
Calculated KPIs
Compliance Closure Rate
54.8%
Closed points / total compliance points
RART Coverage
73.3%
RART prepared / total applicable risks
Deviation Aging (Avg)
42 days
Avg days since deviation approval
High-Risk Open Items
4
Count of high-risk unresolved items
Open Infosec Points
9
Security observations not yet closed
Open IT Compliance Points
13
IT compliance items not yet closed
Deviation Count
7
Number of approved deviations
Disaster Recovery (DR) Details — RTO & RPO
Recovery Time Objective (RTO) and Recovery Point Objective (RPO) targets per application, with DR tier, last test result, and recovery strategy
Tier 1 Apps
2
Avg RTO: 3 hrs
Tier 2 Apps
2
Avg RTO: 10 hrs
Tier 3 Apps
2
Avg RTO: 36 hrs
DR Tests Due (90d)
3
Review schedule
| Application | DR Tier | RTO Target | RPO Target | Recovery Strategy | Last DR Test | Test Status | Next DR Test |
|---|---|---|---|---|---|---|---|
| Core Banking System | Tier 1 | 4 hrs | 1 hr | Active-Active | 12 Apr 2026 | Passed | 12 Oct 2026 |
| Payment Gateway | Tier 1 | 2 hrs | 30 min | Active-Passive | 05 Mar 2026 | Passed | 05 Sep 2026 |
| Customer Portal | Tier 2 | 8 hrs | 4 hrs | Warm Standby | 20 Feb 2026 | Partial | 20 Aug 2026 |
| Reporting & Analytics | Tier 3 | 24 hrs | 12 hrs | Cold Standby | 10 Jan 2026 | Passed | 10 Jul 2026 |
| HR & Payroll System | Tier 2 | 12 hrs | 6 hrs | Warm Standby | 15 Mar 2026 | Failed | 15 Jun 2026 |
| Document Management | Tier 3 | 48 hrs | 24 hrs | Cold Standby | 28 Jan 2026 | Passed | 28 Jul 2026 |
Infosec Points Trend
Monthly Infosec security observations raised, closed, and remaining open — 8-month rolling view
IT Compliance Issue Trend
Monthly IT compliance issues raised, closed, and remaining open — 8-month rolling view
Open vs Closed Compliance Issues
Monthly stacked view of open and closed compliance items across Infosec and IT compliance
RART Status
Risk Assessment & Risk Treatment document preparation status across applicable risks
Compliance Aging
Open Infosec and IT compliance items grouped by aging bucket — days since issue was raised
Risk Treatment Heatmap
Risk items with likelihood, impact, treatment status, and RART preparation — colour-coded by severity
| Risk Item | Likelihood | Impact | Treatment Status | RART Done |
|---|---|---|---|---|
| Data Breach | High | Critical | in-progress | ✓ Yes |
| Unauthorised Access | Medium | High | treated | ✓ Yes |
| Compliance Violation | High | High | open | ✗ No |
| Patch Non-compliance | Medium | Medium | in-progress | ✓ Yes |
| Vendor Risk | Low | High | treated | ✓ Yes |
| Config Drift | High | Medium | open | ✗ No |
| Audit Finding | Medium | Low | treated | ✓ Yes |
| Deviation Overrun | Low | Medium | accepted | ✓ Yes |
Deviations Register
Approved exceptions to standard protocol — with aging, risk level, approver, and current status
| ID | Description | Approved By | Approved Date | Aging (Days) | Risk Level | Status |
|---|---|---|---|---|---|---|
| DEV-001 | Patch cycle extended from 30 to 60 days for legacy system | CISO | 01 Mar 2026 | 73d | High | Active |
| DEV-002 | MFA exemption for batch processing service account | IT Head | 15 Mar 2026 | 59d | High | Active |
| DEV-003 | Firewall rule exception for third-party integration | CISO | 22 Mar 2026 | 52d | Medium | Active |
| DEV-004 | Audit log retention reduced to 6 months for test env | Compliance | 01 Apr 2026 | 42d | Low | Active |
| DEV-005 | Encryption standard downgrade for legacy API endpoint | CISO | 10 Apr 2026 | 33d | High | Under Review |
| DEV-006 | Password complexity relaxed for service desk accounts | IT Head | 20 Apr 2026 | 23d | Medium | Active |
| DEV-007 | Vendor access without full background check (temp) | Compliance | 01 May 2026 | 12d | Medium | Active |
Calculated KPI Definitions
Formulas used to derive each compliance and risk metric
Open Infosec Points
Total Infosec raised − Total Infosec closed
Open IT Compliance Points
Total IT compliance raised − Total IT compliance closed
Deviation Count
Count of approved active deviations
Deviation Aging
Days since deviation approval date (per deviation)
RART Coverage
RART prepared ÷ Total applicable risks × 100
Compliance Closure Rate
Closed compliance points ÷ Total compliance points × 100
High-Risk Compliance Items
Count of high-risk unresolved compliance items