FAQ
Evaluate C1Risk against the program you need to run. Use these answers to prepare questions about controls, evidence, integrations, implementation, governance, and the scope of your proposal.
Connect the work your team needs to run.
Can C1Risk support our enterprise risk methodology?
C1Risk supports configurable assessment templates, risk and impact scoring, and relationships between risks, controls, issues, assets, and vendors in its enterprise risk workflows. Bring your risk taxonomy, current register, scoring model, appetite thresholds, and ownership structure to confirm how your methodology would be configured.
Can we reuse controls across our framework stack?
C1Risk connects shared controls to multiple requirements and links evidence to the controls it supports in its compliance management workflows. Review your priority frameworks, control library, applicability decisions, and exceptions in a demonstration rather than choosing on a framework count alone.
How are evidence, testing, and issues connected?
C1Risk connects evidence with controls, mapped requirements, testing, issues, owners, and corrective actions, as shown on its Compliance Management page. Ask to trace one evidence item through a control test, a recorded exception, an assigned issue, and follow-up so you can evaluate the full workflow.
How does vendor monitoring lead to follow-up?
C1Risk connects changing signals to the relevant vendor, engagement, assessment, finding, and owner using monitoring tooling built into the platform, as described in its vendor risk workflows. Confirm which sources are in scope for your environment and how a signal should lead to review, reassessment, or escalation.
Define the rollout before you commit.
Can C1Risk work with our existing systems and evidence sources?
C1Risk supports evidence collection through authorized API integrations and manual workflows in its compliance environment. Bring the applications, permissions, evidence types, collection frequency, and read or write operations you need, and ask what is available, configurable, dependent on your team, or outside the proposed scope.
What should we validate about migration and existing workflows?
Prepare an inventory of the records, relationships, attachments, history, scoring models, and workflows you want to retain. Ask C1Risk to confirm migration scope, field mapping, validation, integration access, responsibilities, and any manual work in a written rollout plan.
How should we plan implementation and time to value?
Define milestones around your starting data, priority workflows, required integrations, responsible teams, and acceptance criteria. Agree what will be delivered in each phase, and separate software rollout from remediation and external assessment rather than relying on a generic implementation or audit timetable.
What onboarding and support should our proposal include?
Ask C1Risk to confirm onboarding sessions, configuration assistance, training, support channels, coverage hours, response commitments, and any additional services in your proposal. Clarify who administers the platform after launch and how escalation, documentation, and future changes will be handled.
Keep ownership and assessment boundaries clear.
What security and governance information should we request?
Request the security, privacy, access-control, data-handling, and resilience documentation your procurement process requires. Demonstrate your user roles, review and approval steps, and evidence-access expectations, and confirm retention, export, incident-response, and service commitments separately rather than assuming them from the product category.
Does C1Risk replace an independent auditor or certification body?
No. C1Risk supports readiness and governance workflows; independent assessors make certification, attestation, or authorization decisions, as stated on its Compliance Management page. If you need help identifying an assessment provider, ask C1Risk to discuss options and confirm that provider's scope, independence, credentials, fees, and timetable separately.
How should we distinguish SOC 2 Type 1, Type 2, and SOC 3?
SOC 2 Type 1 addresses the design of controls at a specified date, while Type 2 also addresses operating effectiveness over a defined period, according to Schellman's SOC guidance. SOC 3 is a separate general-use report with less detail than SOC 2, not a third type of SOC 2, as described by the AICPA's SOC 3 overview. Confirm which report your customers need and agree scope and timing with your service auditor.
How can we evaluate internal audit and annual risk-assessment workflows?
Use your control-testing plan, evidence requirements, risk-assessment methodology, and issue process as demonstration inputs. Confirm how results, owners, findings, corrective actions, and review history will be recorded, and separately agree any professional services or independent assurance work you require.
Compare the proposed scope, not blanket claims.
What should be included in a pricing and scope discussion?
Request a written proposal covering the workflows, modules, frameworks, users, entities, integrations, implementation services, support, billing term, limits, and any additional charges that apply. Compare the total proposed cost, included services, and scope limits against your requirements before committing.
How should we compare C1Risk with other GRC platforms?
Ask each provider to demonstrate the same requirement, control, evidence item, risk, and unresolved issue using your ownership and approval model. Use the C1Risk platform comparison and framework-stack evaluation to organize your scorecard, then document what each proposal includes rather than assuming feature parity, universal savings, or a guaranteed outcome.
Where can we review customer experience and prepare a demonstration?
Review C1Risk's published customer stories and customer reviews as inputs to your evaluation, not as a guarantee of your own results. Bring your priority workflows, evidence sources, responsible teams, and decision criteria to a scoped demonstration.
Bring your buying questions to C1Risk.
Start with the workflows and decisions you need to support. Ask for a demonstration and proposal scoped to your program.