Risk and compliance operations where every finding reaches the area that must fix it — and closes with evidence

Mi Retail is an operations center that manages the human work around governance, risk and compliance. Your GRC platform or register keeps the risks, controls, policies and audit program; Mi Retail handles what has to happen when one of those records needs people to act. A reported incident, a risk assessment, a corrective action for another area, a risk acceptance that needs a decision and an audit verification each become an Operational Work Item with an owner, a state, a due date and evidence. The areas that must fix the process receive their part in their own My Work, compliance sees what is blocked and why, and internal audit reviews closures against the evidence captured along the way.

No. Your GRC platform — or the spreadsheet that works as your register — stays the system of record for risks, controls, policies, audit plans and ratings, and Mi Retail never keeps a second register. Mi Retail covers the part those tools were not built for: getting people outside the GRC team to act. The register can say that a control failed and a corrective action is due; Mi Retail manages who must carry it out, what it is waiting for, when it must escalate and with which evidence it can close. The areas never have to learn the GRC platform. Keep your GRC platform; Mi Retail takes over where the work leaves it.

An incident is reported — through a form, an area manager or a system alert — and compliance records it as an incident work item that holds the whole case. Compliance assesses likelihood and impact, links the control that failed and opens corrective actions as child work items for each area that must act. If a temporary risk acceptance is needed, it goes to the risk owner as an approval. Each area closes its action with evidence, and a blocked action carries its reason, so compliance knows exactly what is missing. When every action is closed, internal audit tests the fix and closes the finding, or reopens the action that did not hold.

Each corrective action is a child work item of the finding, assigned to a person in the area that must act — procurement, finance, operations, IT or human resources — with a due date and a clear description of the expected result. The owner sees it in My Work next to the rest of the day, not in a platform they rarely open. Area coordinators see their team’s actions in Team Operations and can reassign them. When an action depends on something outside the area, such as a system change or a supplier document, it is marked blocked with the reason. Compliance sees every action of every finding in one place, by age and state, without sending a single status email.

A risk acceptance or a policy exception is an approval work item in the risk owner’s queue, with the assessment, the options, the compensating measures and a due date attached. The risk owner approves or rejects from the work item, and the decision is recorded with its reason, its scope and its expiry. If the decision is not made in time, the coordinator sees it at risk and can escalate it to the next level, which receives the same context instead of a forwarded message. When a temporary acceptance expires, a follow-up is created so the exception is reviewed rather than silently becoming permanent. Leadership sees only the acceptances that exceed the lower levels.

Internal audit receives a verification work item for the finding once its corrective actions are closed, with every action, owner, date and piece of evidence linked to it. The auditor can test a sample, request more evidence from a specific action or reopen it if the fix did not hold, and each of those steps is recorded as part of the same trail. Control & Assurance gives audit a view across findings: which are open, which are overdue, which were reopened and which areas keep missing their dates. Because evidence is captured while the work happens, audit reviews facts instead of rebuilding them from emails and screenshots.

No. Mi Retail does not certify an organization, interpret regulations or decide whether a control is adequate; those judgments belong to your compliance team, your auditors and, where relevant, your regulators. What Mi Retail provides is operational discipline around those judgments: every incident, action, approval and verification has an owner, a state, a due date and evidence, and the trail shows who decided what and when. That record can support an audit or a regulatory review, because it shows that the organization acted on what it found. The conclusion about compliance, however, always stays with the people and bodies responsible for it, not with the software.

Obligations, policy reviews and contract milestones generate work on a calendar, and Mi Retail turns each one into a work item when it needs a person. A regulatory report due at quarter end, a policy that must be reviewed every year, a contract renewal notice or a supplier certificate about to expire becomes a work item with an owner and a due date well before the deadline. The owner prepares the deliverable, the approver signs it off from the same work item and the result is stored as evidence. Compliance sees upcoming obligations by area and date, and nothing depends on someone remembering a date in a spreadsheet.

Each role sees what it is responsible for. Area owners see only the corrective actions assigned to them, compliance sees the incidents, findings and actions of the whole program, internal audit sees the trails it must verify, and executives see in Executive Operations only the findings and acceptances that need their decision. Sensitive incidents, such as an internal investigation, can live in a restricted workspace where only the designated people see the case, while the resulting corrective actions go to the areas without exposing the details behind them. Access follows the organization’s identity structure, so when someone changes role, what they see changes with them.

Yes, when they have their own organization on Mi Retail. A request to a supplier — an updated certificate, a completed questionnaire, evidence of a corrective action on their side — can travel as a derived work item that lands in the supplier’s own intake queue; you follow its state and result without seeing their internal work, and your finding closes when theirs does. An external audit firm can take part the same way, or as an external collaborator with a limited surface that shows only the shared work and the evidence it must review. Each organization keeps its privacy, and the exchange stops depending on email threads that nobody can reconstruct later.

The Governance suite of StoneOS brings apps for the domain work of governance, risk and compliance: contracts, obligations, policies, records, risk, controls, compliance, audit, incidents and corrective actions. They sit on top of the Business Core apps every team uses, such as Docs, Drive, Sheets, Chat and To-do. Those apps keep the depth of each domain — the risk register, the control library, the audit program. Mi Retail is where the work they generate meets the people who must act: a control that failed its test, an obligation coming due or a corrective action for another area lands as a work item in the right queue. If you keep your current GRC platform, it stays the record.

Yes. In a small organization, compliance is often one person who also runs finance or operations, and Mi Retail adapts: one Today view with open incidents, actions due this month and upcoming obligations, without committees or hierarchies that do not exist. In a large group, the same work items are distributed across a central risk team, compliance officers per business unit, area owners, internal audit and an audit committee, each with its own surface, and escalations reach the right level. The way an incident, an action or a verification is represented does not change, so the program can grow from one person to several teams without migrating anything.

Start with the findings that are already open, rather than modeling the whole GRC program. Create a workspace for compliance, invite the owners of the areas that have corrective actions pending and move those actions into Mi Retail as work items with an owner and a due date. Within a few weeks you will see which actions are blocked, which areas miss their dates and where evidence is missing. Then bring in incident reporting and risk acceptances, invite internal audit to verify closures, connect the GRC platform or register you already use and, if it fits, add the Governance suite apps from StoneOS. Mi Retail is free to start.