The framework is non-ristrictive and creates an easy setup of the control environment with a connection between risks, controls, control testing and reporting. Review collected by and hosted on G2.com.

Some of the unstructured data is still hard to create value off of. E.g. you have a risk register connected to the controls, but it doesn't show in the controls which risks they mitigate - and you don't have an overview of the controls, and if they all mitigate a control. These problems can of course be solved in other follow-up procedures. Review collected by and hosted on G2.com.