Risk Core
One platform for the whole risk life cycle — identify, assess, monitor, respond, recover. Built for Thai corporate groups and the subsidiaries inside them, from the risk register to the employee's phone.
Who this is for
- Thai corporate groups and the subsidiaries inside them
- Financial groups: group hierarchy, consolidated reporting, Basel-mapped losses
- Corporates & SMEs: BCP Core first, then ERM Core as the layer to grow into
- Companies supervised by the SEC, BOT and OIC
1The whole risk life cycle, one platform.
VideoRisk Core in 80 seconds80 seconds · sound on · captions in the video
2Two modules on one core.
| No. | Module | What it covers |
|---|---|---|
| 2.1 | ERM CoreThe risk desk | RCSA · Loss Event · KRI · BIA · Dashboards and group roll-up |
| 2.2 | BCP CoreEvery employee's phone | Hazard watch and early warning · BCP level and command · Check-in and status map · Routes · Call tree and group chat · Exercise log |
| 2.3 | Shared coreBoth modules | Organisation structure · staff register · one identity · roles · action register · audit log |
- Modular: ERM Core only, BCP Core only, or both on one core.
- An incident in BCP Core becomes a loss event in ERM Core without re-keying.
- The BIA in ERM Core tells BCP Core which activities are critical, how fast each must recover and how many people it needs.
- Dashboards in Thai and English.
3Group governance, enforced in the database.
Each company's data is separated by row-level security, including companies of the same group; a separate database per company on request. Companies in a group are linked only by report-up.
- 3.1
Down-Only Visibility
A parent sees downward only; siblings never see each other.
- 3.2
Subsidiary-Independence
A parent reads but never acts; the database refuses, not just the screen.
- 3.3
Report-Up-Only
Data flows up to the parent only; no arrow between siblings.
- 3.4
Reported-Then-Visible
An item becomes visible to the parent only once it has been reported.
4Built to serve COSO ERM and ISO 22301.
- 4.1
COSO ERM (2017)
Enterprise risk in ERM Core: identify, assess and prioritise risks, respond, and see the portfolio.
- 4.2
ISO 22301:2019
Business continuity: the BIA with MTPD, RTO and RPO in ERM Core; BCP levels, command and the call tree in BCP Core.
- 4.3
Basel Level-1 event types
Every loss event is mapped to one of the seven Level-1 event types, gross, recovered and net.
- 4.4
SEC, BOT and OIC
Designed for companies supervised by the SEC, BOT and OIC. Materiality tiers and reporting cycles are configured to each client's regulatory calendar.
5Where ComplyWise fits.
Risk Core holds risk appetite statements, the risk taxonomy and RACI as reference data. The policy and committee work behind them stays with the client. That is the work we do with you.
- 5.1
Risk management framework
How risk is identified, measured and reported: risk appetite, taxonomy, assessment method, indicators and reporting.
- 5.2
Business continuity
Keeping critical services running: business impact analysis, continuity and recovery plans, testing schedule.
- 5.3
Governance and reporting
Board and committee charters, delegation of authority, reporting lines, and periodic risk and compliance reports.