Group management
One head office, many subsidiaries. See which one needs help first.
Multi-entity compliance software for groups. Group management lets the head office see how every company in the group is doing with its rules in one picture, share people, suppliers and KPIs with them, and help the ones falling behind. Each subsidiary stays a full Acuna GRC organization of its own.
KPIs
Computed nightlyGroup Compliance
Live view across the 9 organizations in this groupThe problem
Why does group compliance reporting arrive late and inconsistent? Every site reports its own way.
Each subsidiary keeps its own spreadsheet, the head office sets up the same people, profiles and suppliers again and again, and nobody can say which site needs help first.
Each subsidiary reports compliance in its own spreadsheet, a month late.
Fix: one Group Compliance dashboard reads each organization's live data, and Export CSV gives one row per organization.
We set up the same users, profiles and suppliers again and again.
Fix: add a person to several organizations at once, and push access profiles and suppliers down from the head office.
We cannot tell which subsidiary needs help first.
Fix: a Needs attention rail and a heatmap: each organization reads Critical, Watch, On track or Verified.
How Group management works
How does multi-entity compliance software work in Acuna GRC? Attach, sort, share, watch.
Acuna attaches your subsidiaries to your head office. You sort them by your own dimensions, such as Region or Brand, share people, access profiles, suppliers and KPIs, then watch Group Compliance and act where it slips.
How does a head office see every subsidiary at once?
On Assure → Group Compliance. Tiles total requirement compliance, maturity, organization health, open non-conformities, late corrective actions, ongoing evaluations and active exceptions; click one to rank the organizations, worst first. A Needs attention rail and a heatmap show who slips, with Risks, Vulnerabilities, TPRM and KPIs tabs. When one slips, open its drawer and evaluate it directly.
Read-only: Group Compliance reads each organization's data and writes nothing back.
Evaluate a subsidiary in Evaluations →What does the head office see when it opens one organization?
Click an organization and its drawer opens beside the table: compliance, maturity, ongoing evaluations and items awaiting validation, the requirements bar, open findings by severity, its corrective actions and exceptions, and its risks, vulnerabilities and TPRM bars. Open tenant switches to that organization.
How do we set up people and access across the group without doing it twelve times?
Admin → Group users lists every person across the organizations you administer, with MFA status and last sign-in. Enter an email and a name, tick several organizations, choose a role and an access profile: a new person gets one invitation email. Mark an access profile Managed for the group and its modules, object access and read-only setting follow the head office.
Scopes, tags and assignees stay local, and every change is written to that organization's audit log.
Access profiles in Administration and security →Can subsidiaries share one supplier list?
Yes. Select suppliers in the head office list and click Share with the group: list them in the group catalog, or tick organizations to give them a copy now. In a subsidiary, Add from Library opens on a Group tab, and the copy arrives with the supplier's identity, contacts and saved answers.
Risk exposure, risk level, OSINT score and actual rating follow the head office; status, tier, contacts and contracts stay local.
The TPRM supplier register →How do you measure the same KPI in every subsidiary and roll it up?
Turn on Group KPI on a head office KPI and Acuna GRC copies it into every organization, marked Managed by your group: the subsidiary records values and sets the owner and target. A Group rollup KPI then combines them with On target, Sum, Average, Lowest or Highest, nightly or at once with Recompute now, for example 6 of 9 on target.
Only the values are shared, never the records behind them.
KPIs and measurements in Assure →Aiko and Group management
What does the AI do for a head office? It tells you where the open work is.
As a head office administrator, ask Aiko "Which subsidiary has the most open work?" and it reports compliance and open work in each subsidiary you administer. Once it has read group data in a chat, it always asks first before acting.
Swiss experts
Can experts support the subsidiaries? Yes, CISO as a service.
Done for you: with CISO as a service, our Swiss experts support the subsidiaries that slip, so the head office team is not stretched across every site.
.png&w=3840&q=75&dpl=dpl_Ba6pf7ueYcNioUvDkWkKkJsULeG7)
.png&w=3840&q=75&dpl=dpl_Ba6pf7ueYcNioUvDkWkKkJsULeG7)
CEO of Abilene Group
Henri Haenni
Business continuity and risk management
GRC Consulting team leader
Bénédicte Sévin
GRC project leadership
Do it yourself
You run the program in Acuna GRC, with Aiko.
Done with you
Guidance, reviews and audit preparation with your team.
Done for youOn Group management
Our experts run it. You review.
Integrations
Does Acuna GRC connect to the tools your subsidiaries already use? Yes, 100+ connectors.
Connectors pull security data from identity, endpoint and cloud tools on a schedule, so the evidence behind each entity stays current.
Entra ID
Okta
Google Workspace
Microsoft 365
Defender
CrowdStrike
AWS
Azure
Jira
ServiceNow- 100+ connectors in all
Missing a connector? We build it. See Integrations and API
Connects with
How does Group management fit with the rest of Acuna GRC? One head office view across the platform.
Group Compliance lives in Assure and reads each organization's compliance, risks, vulnerabilities and suppliers. Subsidiaries are evaluation targets, and access profiles, suppliers and KPIs are shared from the head office.
- AssureGroup Compliance lives in Assure
- EvaluationsEvaluate subsidiaries, dispatch findings
- TPRM (Supplier Shield)Share suppliers with the group
- Vulnerability managementVulnerabilities counted per subsidiary
- Administration and securityManaged profiles pushed down
- AikoWhich subsidiary has most work?
FAQ
What else do people ask about multi-entity compliance software?
Does the head office see everything in a subsidiary?
No. Being in the group grants no access by itself: what a head office administrator can reach in a subsidiary comes from their own membership there, and to act in one they must be an administrator there too.
Does each subsidiary keep its own data and settings?
Yes. Each subsidiary is a full Acuna GRC organization with its own people, records and settings. It sees only what the head office sends it: a group KPI, a shared supplier or a managed access profile.
How deep can a group go?
One level: a head office and its subsidiaries. The group features appear in the head office.
Who sets the group up?
Acuna does, on your request: we attach each subsidiary to your head office. You then create your own dimensions, such as Region or Brand, and keep the contacts of each organization.
Do we need Evaluations too?
Yes for Group Compliance, which needs the Evaluations feature. Evaluations also lets you evaluate subsidiaries directly and dispatch findings into their Assure Issues.
We run clients, not subsidiaries. Is this for us?
Group management is built for one group: a head office and its own subsidiaries. Running clients, not subsidiaries? See Acuna GRC for MSSPs.
How do we get Group management, and where is our data hosted?
It is an add-on for organizations with subsidiaries, and Acuna sets up the group. Your data is hosted in Switzerland, the EU or the US.
Start with one step.
Bring the list of your subsidiaries. We'll show you Group Compliance on a sample group, share a supplier and a KPI across it, and walk you through how your group would be set up.
Hosted in Switzerland, the EU or the US