Tender: Procurement of Integrated Governance, Risk and Compliance (GRC) Cloud Platform for The Authority

About

The Authority is seeking a supplier for a scalable, integrated Governance, Risk and Compliance (GRC) cloud software solution to consolidate risk data into a single platform that strengthens oversight, enhances analysis and reporting, improves operational efficiency, and ensures accountability. The required platform must provide a unified view of risks, controls, incidents, actions and metrics with end-to-end traceability across taxonomies, business units, policies and key processes; support risk and control management (risk and control library, RCSA assessments, heat maps and risk scoring), control testing with structured workflows and evidence capture, configurable automated reporting (including Microsoft Office integration and UK Corporate Governance Code Provision 29-aligned reporting), data ingestion from internal and external sources and the use of AI-assisted tooling where appropriate. It must also support risk appetite and KRI monitoring, central incident lifecycle management, policy governance and evidence-based policy effectiveness assessment, regulatory compliance monitoring and horizon scanning, ethics and integrity monitoring (gifts, hospitality, conflicts of interest, insider lists), and internal audit planning and action tracking. The Authority expects an intuitive, cloud-based platform with out-of-the-box configurability, guided workflows and automation to embed first-line ownership while enabling second-line oversight; initial core capabilities have been identified but the full scope and the business units for implementation are still being defined and will be included in future specifications.