Question 1

What is ShelfGRC?

Accepted Answer

ShelfGRC is a cloud-based Governance, Risk and Compliance (GRC) platform that helps organisations manage risks, controls, policies, compliance obligations, incidents, evidence and remediation activities in a single system. It replaces spreadsheets and fragmented processes with a central source of truth for risk and compliance management, combining traditional GRC functionality with AI-assisted workflows, configurable risk frameworks, integrated reporting and audit-ready record keeping.

Question 2

Who is ShelfGRC designed for?

Accepted Answer

ShelfGRC is designed for organisations that need a practical, affordable way to manage risk, governance and compliance. Typical users include Boards, Executives, Risk Managers, Compliance Managers, Internal Auditors, Operations teams and business unit leaders — organisations that want enterprise-grade GRC capabilities without the complexity and cost usually associated with large enterprise platforms.

Question 3

What business challenges does ShelfGRC solve?

Accepted Answer

Many organisations manage risks, controls, incidents and compliance obligations across scattered spreadsheets and disconnected systems, which makes reporting difficult and reduces visibility. ShelfGRC centralises these activities into one platform, improving oversight, strengthening accountability, and maintaining a complete audit trail of decisions and actions.

Question 4

How is ShelfGRC different from traditional GRC software?

Accepted Answer

ShelfGRC is built to be simpler to implement and easier to use than most enterprise GRC platforms, combining configurable workflows, a modern user experience, AI-assisted features and integrated reporting in one environment. A core design principle: AI can draft recommendations and analyse information, but every change still has to be reviewed and approved by a person before it becomes part of the live system.

Question 5

Is ShelfGRC suitable for small and mid-sized organisations?

Accepted Answer

Yes. ShelfGRC is designed to give organisations a scalable GRC platform without requiring large implementation teams or extensive technical resources — you can start with a focused risk or compliance program and expand as your governance requirements mature.

Question 6

What industries does ShelfGRC support?

Accepted Answer

ShelfGRC can be configured for organisations across financial services, government, healthcare, education, technology, professional services, not-for-profits, critical infrastructure and other regulated industries. Because categories, risk frameworks, scoring methodologies and reporting structures are all configurable per organisation, ShelfGRC adapts to a wide range of operating environments.

Question 7

What GRC modules are included in ShelfGRC?

Accepted Answer

ShelfGRC includes seven core registers — Risk, Controls, Policies, Obligations, Incidents, Evidence and Treatment Plans — interconnected to give end-to-end visibility across your governance, risk and compliance program. It also includes dashboards, reporting, AI assistance, workflow approvals, audit trails, data imports and configurable taxonomies.

Question 8

Can ShelfGRC manage enterprise risk registers?

Accepted Answer

Yes. ShelfGRC's Risk Register supports risk identification, assessment, ownership, categorisation and reporting, with risks scored using configurable likelihood-and-impact methodologies and visualised through heatmaps and dashboards. Risks link directly to controls, incidents, obligations, evidence and treatment plans for a complete view of exposure and management activity.

Question 9

Does ShelfGRC support compliance obligations and monitoring?

Accepted Answer

Yes. The Obligations Register manages regulatory, legislative, contractual and internal-policy obligations, each with an owner, a review date, a compliance status and supporting evidence. You can track compliant, partially compliant and non-compliant obligations while linking them directly to controls, policies and remediation activities.

Question 10

Can ShelfGRC manage controls, assurance activities and testing programs?

Accepted Answer

Yes. The Controls Register documents preventative, detective and corrective controls and lets you assess their effectiveness. Controls link to risks, obligations and supporting evidence, giving you a structured foundation for assurance, compliance and audit activities.

Question 11

Does ShelfGRC support incident and issue management?

Accepted Answer

Yes. The Incidents Register records, manages and reports incidents, near misses and breaches, capturing severity, ownership, remediation activities, root causes and lessons learned. Incidents link to risks, controls and treatment plans so emerging issues strengthen the control environment going forward.

Question 12

Can we track risk treatments, actions and remediation plans?

Accepted Answer

Yes. The Treatment Plan Register lets you manage remediation activities, assign owners, set due dates and monitor progress. Treatment plans can link to multiple risks, controls, incidents and obligations at once, which makes complex remediation programs and accountability much easier to manage.

Question 13

What reporting capabilities are included?

Accepted Answer

ShelfGRC includes executive dashboards, board reports, compliance reports, risk reporting, incident reporting, treatment plan reporting and custom reporting — all generated directly from live platform data, reducing reliance on manual spreadsheet-based reporting. The Reporting Canvas lets you build and save custom dashboards and reports tailored to different audiences and governance needs.

Question 14

Can executives view real-time risk and compliance dashboards?

Accepted Answer

Yes. Executive dashboards give leadership teams visibility over risk exposure, compliance performance, incidents, treatment plans and other governance metrics, updated from live platform data so Boards, Executives, Risk Committees and Management always see a current view.

Question 15

Can I create reports for boards, committees and regulators?

Accepted Answer

Yes. ShelfGRC provides standard reports plus custom reports and dashboards through the Reporting Canvas, tailored for Boards, Risk Committees, Audit Committees, Executive Management and regulatory stakeholders. Because every report is generated from linked risks, controls, obligations, incidents and treatment plans, reporting stays consistent and traceable back to the underlying records.

Question 16

Can reports be exported to Excel or PDF?

Accepted Answer

ShelfGRC supports print-ready PDF export for dashboards, standard reports and all seven registers, designed to closely reflect what you see on screen. Every register can also be exported to CSV, which opens directly in Excel, using the same column set as the PDF and standard reports — so exported data always matches what's on screen. Word export is not currently supported.

Question 17

Can ShelfGRC generate automated management reports?

Accepted Answer

Yes. AI-assisted reporting can help draft report narratives and management summaries based on platform data, saving preparation time. Consistent with ShelfGRC's governance approach, every AI-generated narrative remains subject to human review before it's relied on or distributed.

Question 18

How does AI enhance the ShelfGRC experience?

Accepted Answer

ShelfGRC uses AI to assist with document analysis, data imports, reporting, risk classification, compliance mapping and information retrieval — reducing manual effort while improving consistency and productivity. AI is designed to support users rather than replace decision-making; human review and approval stay central to the platform's governance model.

Question 19

Is my data used to train AI models?

Accepted Answer

No. Customer data processed by ShelfGRC's AI features is not used to train AI models — neither by Shelf Labs nor by our underlying AI providers. ShelfGRC's AI capabilities run on enterprise-grade AI services (Anthropic Claude and Amazon Bedrock) under commercial terms that prohibit using customer inputs and outputs for model training. Requests are processed transiently to generate a response, and anything generated or indexed for AI features stays within your ShelfGRC environment, subject to the same tenant isolation, access controls and data residency arrangements as the rest of the platform.

Question 20

Can AI help identify emerging risks and compliance gaps?

Accepted Answer

Yes. AI can analyse information, surface relevant risk and compliance themes, support control-mapping activities and highlight areas that may need further review. These insights are meant to support informed decision-making, not replace professional judgement or your organisation's own review processes.

Question 21

Can AI assist with drafting risk descriptions, controls and treatments?

Accepted Answer

Yes. ShelfGRC can help draft risks, controls, treatment plans and other governance content to speed up documentation and admin work. AI-generated content is presented as a suggested change, never as an automatic update to a live record — every AI-generated recommendation has to be reviewed and approved by a person before it lands in a register.

Question 22

Can AI analyse large volumes of documentation?

Accepted Answer

Yes. ShelfGRC can analyse uploaded documentation and extract structured information for you to review and incorporate into registers and workflows, including AI-assisted field mapping during import — reducing the effort of onboarding existing risk and compliance information.

Question 23

Can AI features be disabled if required?

Accepted Answer

Shelf Labs recognises that some organisations have specific governance, privacy or regulatory requirements around AI. AI functionality is built with strong governance controls and human oversight throughout; organisations with specific AI-governance requirements should discuss their needs with Shelf Labs during implementation and onboarding.

Question 24

How is customer data protected when using AI functionality?

Accepted Answer

ShelfGRC applies the same access controls and permissions to AI interactions that apply throughout the platform — AI responses are scoped to information a user is already authorised to see. The platform's "AI suggests, you approve" design means every AI-generated output stays subject to review and approval before it can affect a live record, reducing the risk of unauthorised or automated changes. Customer data submitted to AI features is not used to train AI models — see "Is my data used to train AI models?" above.

Question 25

Where is customer data stored?

Accepted Answer

You choose where your data is stored — Australia, the United States, Europe, Asia, or India — right when you set up your account. From there, ShelfGRC takes care of the rest: your records and your AI search index both move to your chosen region as we bring it online. Data is encrypted in transit and at rest, and every tenant's data is segregated through dual-layer tenant isolation. Your account identity, billing records and tenant registration always stay in Australia, regardless of your data region. See our Privacy Policy for the full data-residency picture.

Question 26

How secure is ShelfGRC?

Accepted Answer

Security is a core product principle. ShelfGRC layers tenant isolation, role-based access controls, multi-factor authentication, upload validation, malware scanning, rate limiting and immutable audit trails. A key design feature is dual-layer tenant isolation, combining application-level authorisation with PostgreSQL Row-Level Security (RLS), so customer data stays segregated and protected.

Question 27

Is data encrypted both at rest and in transit?

Accepted Answer

Yes. Data moving between users and the platform is protected with TLS encryption, and stored data is encrypted within the underlying cloud infrastructure — security controls designed to align with modern SaaS practice and support customer due-diligence and procurement requirements.

Question 28

How does ShelfGRC manage user access and permissions?

Accepted Answer

ShelfGRC uses role-based access controls — Owner, Administrator or Member — aligned to each user's responsibilities, plus business-unit and organisational-unit level access controls so organisations can restrict visibility to authorised teams only. These permissions apply consistently across registers, dashboards, reports and AI-assisted search.

Question 29

Do customers retain ownership of their data?

Accepted Answer

Yes. Customers retain ownership of the risks, controls, policies, obligations, incidents, evidence and other data they create and maintain in ShelfGRC. ShelfGRC is the platform used to manage, analyse and report on that information — ownership and control stay with the customer, subject to the applicable subscription and data-processing agreements.

Question 30

Can customers export their data?

Accepted Answer

Yes. ShelfGRC supports register exports, board-report generation and PDF exports so organisations can retain access to their governance, risk and compliance information whenever they need it. Customers with broader data-export requirements can discuss them with Shelf Labs during implementation or as part of their subscription.

Question 31

What happens to our data if we cancel our subscription?

Accepted Answer

Customers can request an export of their data before cancelling, and Shelf Labs will work with you to support an orderly transition and retrieval of information where required. Data retention, deletion and offboarding arrangements are governed by the applicable customer agreement and subscription terms — organisations with specific regulatory or contractual requirements should raise them with Shelf Labs during procurement.

Question 32

Which standards and frameworks does ShelfGRC support?

Accepted Answer

ShelfGRC is framework-agnostic. Organisations configure their own risk taxonomies, compliance obligations and control libraries to align with whichever framework they use — the platform is designed to support the practical management of GRC activities rather than enforce one prescribed methodology.

Question 33

Can ShelfGRC support ISO 31000 risk management frameworks?

Accepted Answer

Yes. ShelfGRC's risk-management capabilities align well with ISO 31000 and similar enterprise risk management approaches, supporting risk identification, assessment, treatment, monitoring and reporting. Risk categories, scoring methodologies, appetite settings and reporting structures are all configurable to your own ISO 31000 implementation.

Question 34

Can ShelfGRC support ISO 27001, SOC 2 and other compliance programmes?

Accepted Answer

Yes. ShelfGRC can manage controls, obligations, evidence and compliance activities associated with ISO 27001, SOC 2, NIST, GDPR, privacy frameworks and other regulatory or industry requirements, including mapping controls against multiple frameworks at once. ShelfGRC itself is not currently certified under ISO 27001 or SOC 2 — Shelf Labs plans to commence its own ISO 27001 and SOC 2 compliance programme during 2026, aiming for certification and attestation during 2027.

Question 35

Can ShelfGRC be configured to align with our existing framework?

Accepted Answer

Yes. Risk taxonomies, categories, scoring methodologies, severity ratings, effectiveness scales and reporting structures are all configurable, so you can implement ShelfGRC without redesigning your current risk and compliance methodology.

Question 36

Does ShelfGRC integrate with other business systems?

Accepted Answer

ShelfGRC is a modern cloud platform that supports data import and integration patterns commonly needed in GRC environments. Organisations with specific integration requirements should discuss them with Shelf Labs during implementation and solution design.

Question 37

Can Shelf Labs migrate our existing registers and data?

Accepted Answer

Yes. ShelfGRC imports existing data from spreadsheets and CSV files — risk registers, controls, obligations and other governance records — with AI-assisted field mapping to help match your columns to ShelfGRC records. Imported data goes through ShelfGRC's proposal workflow for review and approval before it becomes live, so migration doesn't come at the cost of data quality.

Question 38

Can different business units maintain separate registers?

Accepted Answer

Yes. ShelfGRC's organisational-unit structures let you manage access and visibility across business units, divisions, regions or subsidiaries, while still supporting consolidated reporting at the enterprise level.

Question 39

Can we customise risk taxonomies, categories and scoring methodologies?

Accepted Answer

Yes. You can configure risk taxonomies, categories, severity scales, control-effectiveness scales, risk-appetite settings and reporting thresholds — or adopt the default 52 Risks® framework — to reflect the way your organisation actually manages governance, risk and compliance.

Question 40

Can ShelfGRC scale as our organisation grows?

Accepted Answer

Yes. ShelfGRC is a multi-tenant SaaS platform built to support organisations as they expand their GRC activities — start with a focused implementation and progressively add users, registers, controls, obligations, reporting and governance capabilities as requirements evolve.

Question 41

Is administrator and user training provided?

Accepted Answer

Yes. Every new customer gets a complimentary 60-minute onboarding and familiarisation video session covering platform navigation, user management, risk and compliance configuration, reporting, dashboards and recommended setup practices. Additional implementation support, training workshops and advisory services are available through Shelf Labs' implementation partner, Notwithoutrisk Consulting, for organisations with more advanced requirements.

Question 42

How frequently is the platform updated?

Accepted Answer

As a cloud-based SaaS platform, ShelfGRC is continuously improved through product enhancements, feature releases and security updates — customers get the benefit automatically, with no software to install or upgrade.

Question 43

How long does implementation typically take?

Accepted Answer

ShelfGRC is designed for rapid deployment through a built-in setup wizard — organisation details, risk framework, scoring methodology, risk appetite settings, user access and reporting preferences. Overall timeframe depends on organisation size, data-migration needs, number of users and any custom configuration required.

Question 44

What is involved in getting started?

Accepted Answer

Getting started means creating your organisation, configuring your risk framework and scoring methodology, inviting users, and importing any existing governance, risk or compliance information. Once configured, you can immediately start managing risks, controls, obligations, incidents, evidence, treatment plans and reporting from a single integrated platform.

Question 45

What support options are available?

Accepted Answer

ShelfGRC includes built-in guidance and an AI assistant that helps users navigate the platform, answer questions about their data, and streamline day-to-day GRC work, plus access to Shelf Labs support for product assistance. Every new customer also gets a complimentary 60-minute onboarding and familiarisation video call after sign-up, and additional implementation support is available through Shelf Labs' implementation partner, Notwithoutrisk Consulting, for organisations with more advanced requirements.

Question 46

How does the ShelfGRC subscription model work?

Accepted Answer

ShelfGRC is a subscription-based SaaS platform, so you get the software, product updates and ongoing enhancements with no on-premise infrastructure to run. Subscription options suit organisations of different sizes — you can discuss pricing, user licensing and implementation options directly with Shelf Labs.

Question 47

Is a free trial or demonstration available?

Accepted Answer

Yes. ShelfGRC offers a 28-day free trial (no credit card required, for trials of up to 5 seats) so you can explore the platform's key features before committing to a subscription. You can also request a personalised demonstration from Shelf Labs to see how ShelfGRC fits your specific governance, risk and compliance needs.

Frequently asked questions

About ShelfGRC

Features & Capabilities

Reporting & Insights

AI & Automation

Security & Data Protection

Standards, Frameworks & Integrations

Advanced Configuration & Administration

Implementation, Support & Pricing