Governance portal roadmap Updated January 2018

Table of Contents 03 About the Governance Portal Roadmap 04 Product Roadmap Methodology 05 Our Vision 06 Features Roadmap 07 Feature Details

About the governance Portal roadmap The Governance Portal roadmap outlines Protiviti’s development intentions with respect to future releases of the Governance Portal. To coincide with Protiviti’s release scoping, it provides detailed itemization of enhancements that have been scoped into the current release while providing high-level overviews of the larger scope areas of focus contemplated for subsequent releases. This document is purposed toward communicating with Protiviti’s Governance Portal customers regarding Protiviti’s contemplated road map so that customers may review, plan for and participate in the advancement of the Governance Portal. The enhancements identified herein are subject to change based on changing client and market demand. Enhancements identified within near-term releases have more certainty than enhancements identified for subsequent periods. Further, releases are based on Protiviti’s intended schedule, and are subject to change based on QA certification of individual releases. The Governance Portal Road Map contains the following sections: Release Schedule – Outlines the scheduled release dates for version updates (X.x.x), dot releases (X.x) and major releases (X). Features Road Map – Outlines contemplated features for future releases of the Governance Portal. The road map includes itemized descriptions of individual features. Technical Schedule – Outlines the current and targeted versions of hardware and software that are certified for running the Governance Portal (e.g. SQL 2017).

Product roadmap methodology Product Management reviews the product backlog with each release in order to prioritize features and enhancement requests for subsequent releases. Product updates are released monthly. Minor releases are released bi-annually (April and October). Major releases are typically delivered every three to four years.

Our Vision To improve our customers’ corporate governance through simplicity, connectivity and automation. To achieve this, our roadmap is focused on the following themes: Practitioner’s Toolkit Allow practitioner’s to efficiently do their work in the system through purpose-built screens, one-click access, and seamless document management that reduces time spent on data input and report aggregation. Enterprise Hub Provide an extensible framework to manage complex data models while integrating with enterprise software and reporting solutions to embed GRC information and processes in the day-to-day activities of both frequent and infrequent users. Business Process Improvement Incorporate digital technologies such as Robotics Process Automation (RPA) and machine learning to enhance corporate governance through process automation and advanced analytics.

Features roadmap Component V4.11 V4.12 (October 2018) V4.13 (February 2018) Next 12 Month Themes (5.0) eGRC Register Action Plan Improvements Document Group Configurability Configuration Form Refactor Projects / Audits Project RCM Workpaper Project Workbench Replacement / Redesign Workflow & Survey Record-Level Role Assignment Calculated Fields Time-based Notifications Reporting & Analysis Custom Query Search Updates Dashboard Updates Platform-Wide Extensibility Framework Configuration Form Framework Enterprise Content Management Enterprise Reporting Integration Enterprise Workflow and Automation Integration MS Office Suite Integration Data Feed Updates Improved Mobile Device Support Machine Learning

Feature details GRC Register Description Projects / Audits Action Plan Improvements Action Plans will continue to be enhanced to allow for linkage to RCM Tests and Dependent Action Plans. Document Group Configurability Support form configuration for the Document and Document Management pages. Configuration Form Refactor Refactor default system forms to utilize the new configuration form framework that will provide increased extensibility and configurability options as well as drive a new v5.0 user interface paradigm. Projects / Audits Project RCM Workpaper For clients who do not pre-create their objectives, risks, controls and tests (RCM) in the Entity Hierarchy, the Project RCM workpaper will provide the option to create RCM information within a Project without the connection or link back to the Entity Hierarchy. Project Workbench Replacement or Redesign The Project Workbench was built using Microsoft Silverlight, which is a technology Microsoft no longer supports as a result of newer favored technologies. Using a phased approach, we have begun replacing other GP functionality that leveraged Silverlight (e.g. Multilingual, Scheduler, Time & Expense). We are currently evaluating market needs and existing client usage to determine if the best approach is to invest in a full Silverlight replacement or a redesign of the Workbench functionality.

Feature details Cont’d Workflow & Survey Description Record-Level Role Assignment Adding the ability to configure custom role assignment fields on for existing and custom RCM and project forms for utilization in workflow management. Calculated Fields (Updates) This feature will augment existing custom calculation capabilities to introduce mathematical calculation options through the user interface (e.g. addition, subtraction, multiplication, division, min/max) for a single record in addition to the current look-up based calculations. Time Based Notifications This feature will complement recently introduced pre-filtered, editable search features to allow for time-based notifications (i.e. notifications based on a certain date and status related to specific record) without requiring deployment of tasks. The intention of this feature is to reduce the requirement of task deployment and management for task-based workflow in order to make system administration simpler and more efficient. Reporting & Analysis Custom Query The existing capability to develop custom queries within the ad hoc reporting engine will be updated to provide system administrators the ability to build new view definitions through the user interface. Continued improvements will incorporate the ability to introduce calculated columns into custom queries. Search Updates Searches will be enhanced by adding capabilities such as the following: Implement additional settings such as the ability to define/fix column widths, global max records setting, and administrator ability to overwrite/change other users searches. Dashboard Updates Continued enhancement of the GP’s proprietary reporting engine based on customer feedback and report-type requests. Examples include enhancing the drill down/search screen to allow for result set filter and export, along with usability updates such as adding the ability to click a smaller dashboard tile to view it in full screen and the ability to define a chart label.

Feature details Cont’d Platform Wide Description Extensibility Framework The Extensibility Framework provides the ability for system administrators (i.e. non-developers) to model new entity and record types for rapid development of new or custom Governance Portal solutions. Updates to the framework will occur within dot releases leading into v5.0 and will include but not be limited to: Ability to associate a Dependent record directly to an RCM without requiring a sub-RCM record type that originates in the RCM. Creation of the ability to categorize entity and record types into specific “classes” that allow like record-types to inner-operate with one another for purposes of linking, instantiating and importing records within entities. This will improve the ability to create custom frameworks that contain definitional content while creating unique instances of framework elements for support of entity-specific data capture (e.g. assessments, applicability, etc.). Ongoing improvements based on client feedback. Configuration Form Framework The Configuration Form Framework provides the ability for system administrators (i.e. non-developers) to define field labelling, placement and additional characteristics on forms such as required, drop-down choices and other features. A new framework will be introduced in V4.11 that will support configuration of extensible entity and record types without requiring developer intervention. In v4.12, feature parity with the current C-form framework will be implemented. In v5.0, this feature parity will allow the existing OOB record types to be translated into the new configuration framework. Updates to the framework will occur within dot releases leading into v5.0and will include but not be limited to: Form sectioning Tab configuration Conditional layouts Enterprise Content Management Integration with MS SharePoint and O365 will continue. In v4.11, improved security synchronization between the GP record types and MS SharePoint document libraries will prevent users from accessing documents through MS SharePoint while still enabling seamless edit/save in the GP. Incremental enhancements will continue to be incorporated based on client feedback.

Feature details Cont’d Platform Wide Description Enterprise Reporting Integration The existing API that allows enterprise reporting solutions to call GP saved searches to easily extract data without requiring intimate DB knowledge will be enhanced to establish connectors with specific reporting solutions. The connectors will be purpose-built for a given reporting solution, and support end-user security trimming as well as report generation directly within the GP. Specifically, a connector with Power BI will be introduced in v4.11. Additional connectors for Tableau and SQL Reporting Services will be introduced in subsequent releases. Enterprise Workflow and Automation Integration The native GP workflow engine will be augmented for customers wishing to perform advanced workflow as well as support Robotics Process Automation (RPA) for process and controls automation. Potential integration partners will include Nintex for advanced workflow, and Blue Prism or UI Path for RPA. MS Office Suite Integration Continued investments will be made in the dynamic synchronization of MS Office data (e.g. using Excel to refresh GP data). This builds upon the current capability to download dynamically refreshed data in MS Excel and Word with the ability to make live edits in MS Word and uploaded directly into the GP. Data Feed Updates The existing content utility will be updated to allow mapping of columns in identified data sources (e.g. Excel, csv, SQL DB) to GP fields rather than prescribe fixed data formats. This will allow for more flexible integration capabilities with source systems without requiring developer intervention. Improved Mobile Device Support v5.0 form layouts will support responsive design to enable GP web pages to render well on a variety of devices and windows or screen sizes. Continuing into the 5.x series, purpose-built mobile applications will support key GP activities to support simple edit and review capabilities as well as report viewing. Machine Learning Leverage machine learning for greater data analysis to help our customers identify patterns and make decisions with minimal human intervention.