Reporting
Generate standard reports, build a canvas, and share the Executive Overview.
12 min read9 sectionsAll roles (Executive Overview and Reporting Canvas: owners and admins only)
Reports turns your registers into documents you can circulate. Generate a standard report for a risk committee or audit, build a custom canvas for a recurring review, or open the Executive Overview for a board-level summary of your whole programme.
Open Reports from the sidebar to reach every reporting surface from one page.
Executive Overview
A board-level summary of your whole programme. Owners and admins only.
Reporting Canvas
Custom drag-and-drop reports from live data blocks. Owners and admins only.
Standard Reports
Twelve pre-built report types, generated on the hub itself.
Report History
Every report and canvas export already generated, ready to find and reopen.
Six summary reports each cover one area of your programme; six register reports each print a complete register.
Summary reports
- Enterprise Risk Profile
Residual ratings, the heatmap, risks without a treatment plan, top risks, risks by category, a monthly trend and changes in the period.
- Obligations Report
Compliance status, linked-control effectiveness, obligations by source, overdue obligations and changes in the period.
- Incident Summary & Trends
New incidents in the period, overdue reviews, incidents by business unit, recent notifiable breaches, open incidents without a treatment plan, root causes, control failures and 12-month trends.
- Policy Report
Overdue and upcoming reviews, overdue reviews by age, business unit and owner, and reviews due over the next 12 months.
- Treatment Plan Report
High-rated risks with no plan, overdue plans and their linked records, plans due soon, owner accountability, priority and 12-month due-versus-completed.
- Controls Report
Effectiveness on each risk and obligation link by register, unit and category, risks behind weak controls, control gaps, overdue reviews and control failures.
Register reports
- Risk Register
Every risk, with ratings and linked items.
- Obligations Register
Every obligation, with compliance state and links.
- Controls Register
Every control, with ownership, review cadence and links.
- Policies Register
Every policy, with lifecycle state and links.
- Incidents Register
Every incident, with root cause and control-failure detail.
- Treatment Plans Register
Every treatment plan, with status, owner and linked risks.
A register report is a document, not a table: a summary listing every record in scope, then Register detail (public and non-privileged) with one block per record that is not Confidential, Privileged or Highly sensitive. Standard reports are tables and charts built directly from your data, with no AI-written commentary, and use your organisation's own severity labels and effectiveness scale.
The hub walks you through numbered steps, and the report opens in a preview you can export.
- 1
Choose a report type
Click one of the twelve cards under Choose a report type. Each card shows a one-line description and the report's key metrics.
- 2
Set the reporting period
Pick a preset (7 D, 30 D, 90 D, 6 M, 12 M, YTD, All) or Custom. The default is the last 30 days. If you can see more than one business unit, a unit picker appears beside it.
- 3
Click Generate Preview
ShelfGRC builds the report from live data and opens it in a preview. View Last Report reopens it if you close the preview.
- 4
Export your report
In the preview toolbar, Download PDF opens the report as an A4 landscape document in a new window with your browser's print dialog; choose your browser's save-as-PDF option. JSON downloads the raw report data.
Most of a report describes your registers as they stand today, so the period narrows less than you might expect.
In the summary reports, the period applies only to activity: new incidents in the Incident Summary, and the changes tables in the Enterprise Risk Profile and Obligations Report. Everything else shows the register as it stands today, and monthly charts count from the day you generate the report. The Incident Summary labels the two: its headline figures are marked Register today, and its period-scoped sections — new incidents by rating and incidents by business unit — In period. Register reports always include the complete register.
Choosing a business unit narrows the whole report to that unit and every unit beneath it. The top unit (marked root, usually Whole Business) is the exception: it reports only the records held at that level, not assigned to any unit beneath it — so it plus each unit directly beneath it adds up to All units. Leave it on All units to report on everything you can see. The picker offers only units within your access, so it narrows a report but never widens it.
A report lists every record in the business units you can see. How much it shows of each record depends on the record's sensitivity, not on your own access.
- Public, non-privileged
Shown in full: counted, named, and given its own block in the register detail.
- Confidential
Counted in every figure and listed in the summary with Confidential in place of its title and description; it gets no register detail block. The same for everyone, whatever their access.
- Privileged
Counted and listed the same way, named Privileged — or Confidential, when it is both.
- Highly sensitive
Counted and listed the same way, named Highly sensitive — for the people it is restricted to as well. No report shows its content.
The report says so itself. A register report's cover reads that all records in scope are listed, and that confidential, privileged and highly sensitive ones appear in the summary with their classification in place of the title and description and are left out of the register detail, which covers public and non-privileged records only. A summary report carries the note Counts every record in scope. Confidential, privileged and highly sensitive records are named by their classification only. A report generated before this change is withheld in Report History, with a notice asking you to generate it again.
Every standard report and canvas export is recorded so you can find and reopen it later.
Filters and columns
- Type filter
All types, Standard or Canvas.
- From / To
Limit the list to reports generated between two dates. Clear all filters resets them.
- Report Name, Type, Generated By, Generated At
Who generated each report and when. Load more fetches older entries.
- Actions
Details on a standard report; Open on a canvas export.
Details shows the report's scope, period and who generated it. Open report, shown when the report's contents were stored, displays exactly what was generated at the time without regenerating anything, and you can export it again from there. Generate a fresh report takes you back to the hub.
Owners and admins with whole-business access see every report in the organisation. Other owners and admins see their own reports plus reports scoped to units within their own access. Members see only their own.
A pre-built, always-current summary of your organisation's posture, for owners and admins.
Five headline tiles show risks at your High band and above, open incidents at your critical severity, your compliance rate, overdue treatment plans and the share of policies overdue for review. Click a tile to open the matching register, filtered. Forward-Look Workload charts what falls due across your registers over the next 12 months.
Sections (click a heading to collapse or expand it)
- Executive Risk Profile
12-month trend, heatmap and register of High-and-above risks, category tolerance breaches, overdue treatment plans and residual rating changes.
- Compliance & Breaches Profile
Compliance score, obligation status, obligations assessed Not Compliant, and compliance by source and month.
- Incident Management Report
Active incidents, incidents by business unit, overdue plans tied to open incidents and 12-month trends.
- Treatment Plans
Plan KPIs, performance charts and the treatment plan register.
- Controls Profile
Control effectiveness, control gaps and the controls register.
- Policy Overview
Review status, overdue policies and the policy register.
Export at the top opens a menu: three PDF options — tuned for Chrome/Edge's own “Save as PDF”, the Adobe PDF printer, or Microsoft Print to PDF — plus PowerPoint, to lift sections into your own deck. The PDF button on an expanded section exports that section alone. Refresh reloads the figures.
Compose your own report by placing live data blocks on a grid, for owners and admins.
- 1
Open Report Canvases
Click Reporting Canvas on the hub to see every canvas in your organisation. Hover over one to rename, duplicate or delete it.
- 2
Click New Canvas
The editor opens with the Block Palette on the left.
- 3
Add blocks
Drag a block from the palette onto the grid, or click it to add it at the bottom of the canvas. Give it an optional title and subtitle.
- 4
Arrange the layout
Drag a block by its grip handle to move it, drag its bottom-right corner to resize it, and use the duplicate and remove buttons that appear when you hover over it.
- 5
Set the scope
The business unit and date range controls in the toolbar apply to the data blocks and are saved with the canvas.
- 6
Preview and export
Preview shows the finished report. Export opens a menu to save it as a PDF (pick Standard, Adobe or Microsoft, matching how you'll open or print it) or as a PowerPoint deck, and records the export in Report History.
Data blocks are calculated for whoever is viewing, so people who see different business units can see different figures on one canvas. Sensitivity makes no difference: a Confidential, Privileged or Highly sensitive record is counted and named by its classification word only, for everyone. On a small screen the canvas is read-only, but you can still change the scope, preview and export.
The palette groups blocks by area, plus text blocks for structure and commentary.
- Risk
Risk Heatmap, Risk Trend Chart, Management Summary, Residual Risk Rating Changes, Overdue Treatment Plans, Total Open Risks, Risk by Category, and a filterable Risk Register.
- Compliance
Compliance Dashboard, Compliance Score.
- Incidents
Incident KPIs, Incidents by Severity.
- Controls
Control Effectiveness, Control Effectiveness KPI.
- Policies
Policy KPIs, Policy Review Status.
- Treatment Plans
Treatment Plan KPIs, Treatment Plan Progress.
- Text
AI Narrative, Section Title, Text Block, Heading, Body Text, Caption.
- 1
Add an AI Narrative block
Drag it from the Text group. Add at least one chart or KPI block to the canvas first.
- 2
Pick the tile to write about
Choose it in Which tile should this describe?
- 3
Say what you want written
For example, a board-level paragraph on what the tile shows and what needs attention.
- 4
Click Write
The narrative appears in the block. Use Edit to change the text, or Rewrite to generate it again, which replaces your edits.