One Platform, Nine Modules, One Source of Truth
Every Arbor GRC module runs on the same core. Controls, evidence, policies, audits and corrective actions are shared, so work done in one place counts everywhere it applies.
| Ref | Item | Owner | Status |
|---|---|---|---|
ERM-031 | Key supplier failure disrupts service | Owner 1 | High |
ERM-027 | Regulatory change not tracked | Owner 2 | Medium |
ERM-019 | Loss of critical staff knowledge | Owner 3 | Medium |
ERM-012 | Budget overrun on core programme | Owner 4 | Low |
Start with One Module. Add More When You Need Them.
A module you do not license is not greyed out or locked. It simply is not there.
ISMSInformation Security
Run ISO 27001, ISO 27017 and UAE IA from one set of controls.
ISO 27001UAE IAISO 27017ERMEnterprise Risk
One register for your strategic, operational, financial, reputational, legal and environmental risks, with third-party risk management built in.
ISO 31000COSO ERMISO 27001BCMSBusiness Continuity
Profile your departments, run the business impact analysis, build recovery plans and test them.
NCEMA 7000ISO 22301ISO 27001PRIVACYPrivacy
Keep your records of processing current, answer data subject requests on time, and run DPIAs, consent and breach handling against UAE PDPL, ISO 27701 and GDPR..
UAE PDPLISO 27701GDPRITSMIT Service Management
Show your service management system meets ISO 20000, with practices aligned to ITIL, without a separate tool.
ISO 20000ISO 27001ISO 22301AIMSAI Management
Regulators and customers want to see AI governed.
ISO 42001NIST AI RMFISO 27701QMSQuality Management
Run your quality management system against ISO 9001 without a separate tool.
ISO 9001ISO 45001ISO 20000OHSMSHealth and Safety
ISO 45001 helps organisations of any size prevent work-related injury and ill health.
ISO 45001ISO 9001ISO 31000CARFAccreditation
CARF surveyors check conformance standard by standard.
CARFISO 9001ISO 45001Arbor AI
Describe a risk, a supplier or a gap in one sentence and Arbor AI fills in the record. Your team reviews and approves every suggestion.
Try Arbor AIThird-Party Risk Management
Tier suppliers, send due diligence questionnaires through a secure link and score the answers, all in the same risk register.
Explore TPRMOne Core Behind Every Framework
Audits, assets, evidence, policies and corrective actions are shared by every module.
Audit Management
Compliance audits with findings, and scored assessment audits. Reports signed by the auditor and your GRC lead, then locked.
Asset Register
Assets with owners and CIA ratings. Criticality flows into risk scoring.
Evidence Repository
Upload once, link to any control, risk or finding. Versions kept, expiry warnings sent.
Policy Management
Review, approve and track who acknowledged which version and when.
Corrective Actions
Gaps and findings become actions with owners, due dates and escalation.
Dashboards and Reports
Role-based dashboards and regulator-ready reports in PDF and Excel.
Reminders and Escalation
Owners hear before the due date. Managers hear when it slips.
Excel Import and Export
Bring your existing registers in on day one. Export any list when you need it.
Your Whole Programme in Four Steps
Set Up
Your structure, scope and frameworks.
Assess
Gap assessments, risk scoring and business impact analysis.
Act
Treatment, corrective actions, policies and evidence.
Prove
Dashboards, audits and regulator-ready reports.
Frequently Asked Questions
Can We Start with One Module?
Yes. Start with the module you need most and switch on others when you are ready.
Do Modules Share Data?
Yes. Assets, evidence, policies, audits and corrective actions are shared across every module.
Can Arbor Be Configured to Our Process?
Yes. Fields, forms, workflows, risk matrices and organisation structure follow your requirements.
See Arbor GRC with Your Own Frameworks
Bring your current risk register. We can import it from Excel during the demo, so you see your own risks in Arbor, not ours.