Governance Graph
See how your management system fits together.
The Governance Graph links controls, risks, evidence, assets and owners. You see what a change affects and who is responsible, for your ISMS and your AI management system.
Hosted in the Netherlands. Your data stays in the EU.The graph in brief
- Objects
- Controls, risks, evidencePlus assets, suppliers, AI systems and owners
- Relations
- Explicit linksVisible from every object
- Ownership
- Per objectWho is responsible, at a glance
- Audit trail
- Every action recordedImmutable and exportable for audits
01 / Relations
Every object,
in one model.
Controls, risks, evidence, assets and owners are not stored in separate lists. They are linked, so you can follow a question from one object to the next.
- Risk and control
Which controls reduce a risk.
- Control and evidence
Which documents show that a control works.
- Control and asset
Which systems a control applies to.
- Owner and object
Who is responsible for a control, risk or asset.
- Supplier and requirement
Which requirements apply to a supplier.
- AI system and impact assessment
Which assessment covers an AI system, for ISO 42001.
02 / Example
From AI system
to owner.
An example for ISO 42001. Each step is a linked object, so you can follow the line in both directions.
- AI systemCustomer support assistant
Answers customer questions with a language model.
- RiskIncorrect advice to customers
An answer is wrong and a customer acts on it.
- Impact assessmentEffects on customers
Who is affected and how severely.
- ControlHuman oversight
A support agent reviews answers in defined situations.
- EvidenceReview procedure and test results
Linked once to the control.
- OwnerProduct Owner
Reviews the evidence and decides on follow-up.
The example is illustrative and contains no customer data.
03 / What you use it for
Questions you can now answer.
What does this change affect?
See which controls, risks and standards are touched when a system, supplier or control changes.
Who is responsible?
See the owner of every control, risk and asset, and what is still open for them.
What did we do, and when?
Every action is recorded in an immutable audit trail that you can export for audits.
04 / Questions
Questions about
the graph.
What is the Governance Graph?
The model in Basenorm that links controls, risks, evidence, assets, suppliers, AI systems and owners. It shows how they relate across your management system.
How does it help in an audit?
You can show for each control which risks it addresses, which evidence supports it and who owns it. The audit trail records every action.
How does AskNorman use the graph?
AskNorman uses the relations between controls, risks, evidence and owners to answer your questions in context. You review the evidence yourself.
Book a demo
See how your management system fits together.
Together we look at your controls, risks and owners.
- How your controls, risks and evidence connect.
- Who owns what, and what is still open.
- How the audit trail supports your audits.
Hosted in the Netherlands. Your data stays in the EU.