GRC Software for Kenyan Organisations
Kenya's governance, risk, and compliance environment is one of the most layered in East Africa.
Risk Heat Map — 5×5 Matrix
← Low Likelihood High →
Active Risk Items
Industry Risk Landscape
Understanding the Risk Environment
Kenya's governance and regulatory environment has undergone a significant transformation over the past decade, driven by constitutional reforms, the devolution of government, and a rapidly expanding financial services sector that demands world-class risk management.
Key risk areas covered
- Mwongozo Code Governance & State Corporation Reporting
- DPA 2019 Data Protection Compliance (ODPC)
- CBK Risk Management & Prudential Guidelines
- CMA Corporate Governance for Listed Companies
Key Frameworks & Standards
See how Dimeri maps your risks to the right frameworks automatically.
Book a Demo →Core Risk Use Cases
Built for How Your Industry Actually Works
Mwongozo Code Governance & State Corporation Reporting
The Mwongozo Code requires state corporations to demonstrate governance outcomes across board effectiveness, risk management, internal audit, ethics, and stakeholder engagement.
- Dimeri maps every risk in your register to the relevant Mwongozo governance principle, tracks the status of each governance outcome, and generates compliance reports structured to the format that parent ministries, the SCAC, and parliamentary oversight committees expect.
- Board chairs and CEOs of state corporations can see at a glance which Mwongozo requirements are fully addressed, which have gaps, and what remediation actions are underway.
DPA 2019 Data Protection Compliance (ODPC)
DPA 2019 compliance requires registration with the ODPC, documented lawful basis for every category of personal data processed, data protection impact assessments for high-risk processing, breach notification within 72 hours, records of processing activities, and evidence of appropriate technical and organisational safeguards.
- Dimeri creates a structured DPA 2019 compliance register that links every processing activity to its lawful basis, tracks consent records and data subject access requests, manages cross-border transfer documentation, and logs data breach incidents with ODPC notification timelines.
- Each processing activity is linked to the responsible data protection officer, and compliance status is visible on a real-time scorecard.
CBK Risk Management & Prudential Guidelines
The CBK Prudential Guidelines require commercial banks and microfinance institutions to maintain comprehensive enterprise risk management frameworks with documented risk registers covering credit risk, market risk, operational risk, liquidity risk, technology risk, and cybersecurity risk.
- Banks must conduct periodic stress tests, report risk exposures to the CBK, and ensure the board risk committee actively oversees the risk management function.
- Dimeri provides a structured risk register that maps every risk to the specific CBK guideline it addresses, tracks control effectiveness with quantitative metrics, and generates the periodic risk reports that banks submit to the CBK.
CMA Corporate Governance for Listed Companies
The CMA Code of Corporate Governance Practices requires NSE-listed companies to establish governance structures that include independent board oversight, functioning audit and risk committees, documented risk management frameworks, and transparent governance disclosures in annual reports.
- Dimeri maps your risk register and governance activities to the specific requirements of the CMA Code, tracks compliance with continuing listing obligations, and generates governance disclosures structured to the format that the CMA and NSE expect.
- Board secretaries and company secretaries of listed companies can produce governance sections of the annual report directly from Dimeri's live data — showing board composition and evaluation outcomes, risk committee activities and findings, risk management framework maturity, and compliance with each CMA Code requirement.
Digital Risk Register
GRC Register — Kenyan Regulatory View
Control & Incident Tracking
Three Lines of Defence — Tracked and Tested
Every risk in your register links to preventive, detective, and corrective controls. Effectiveness percentages update as evidence is logged. Full audit trail for regulators.
Kenyan Regulatory Obligation Mapping
Every applicable Kenyan regulation — Mwongozo Code, DPA 2019, CBK Prudential Guidelines, CMA Code, PFM Act 2012, IRA requirements, SASRA standards — is mapped to the specific risks and controls in your register. When the ODPC issues new guidance, the CBK publishes an updated prudential circular, or the CMA amends listing requirements, Dimeri identifies which existing risks are affected and flags any gaps in your control coverage. Obligation owners receive automated reminders before compliance deadlines — including ODPC registration renewal dates, CBK periodic reporting deadlines, and CMA annual governance disclosure timelines. The mapping is maintained as a living document rather than a point-in-time exercise, ensuring your organisation stays ahead of Kenya's evolving regulatory landscape.
Multi-Regulator Compliance Scorecard
A single-screen traffic-light scorecard shows your compliance status against every Mwongozo governance principle, DPA 2019 requirement, CBK prudential guideline, and CMA Code obligation. Each item is rated green, amber, or red based on current evidence and control effectiveness, with trend arrows showing whether compliance is improving or deteriorating. For organisations regulated by multiple Kenyan bodies — such as a bank that must satisfy CBK, CMA, and DPA 2019 requirements simultaneously — the scorecard provides a consolidated view that eliminates the need to maintain separate compliance trackers for each regulator. The scorecard updates automatically as assurance activities are completed and evidence is uploaded, giving the board risk committee a real-time view of the organisation's regulatory posture without waiting for quarterly reports.
Remediation Workflow & Regulator Reporting
When a governance gap, compliance breach, or audit finding is identified — whether from an internal review, an ODPC audit, a CBK examination, or an Auditor-General report — Dimeri creates a structured remediation workflow with assigned owners, due dates, and evidence requirements. Progress is tracked through to closure with a full audit trail. Board and committee reports are generated automatically from current data, showing risk profile changes, remediation progress, emerging risks, and compliance status across all applicable Kenyan frameworks. For state corporations reporting to parent ministries and parliamentary committees, the reports are structured to the format that Mwongozo and the PFM Act require. For banks reporting to the CBK, risk reports align to the prudential reporting templates. The manual process of compiling governance reports from scattered spreadsheets and departmental inputs is replaced by automated, evidence-based reporting.
Risk Register Software vs Excel
Why Spreadsheets Fail in This Industry
Spreadsheets cannot handle the complexity, volume, and real-time demands of modern industrial risk management. Here is where they consistently break down — and what Dimeri does instead.
Frequently Asked Questions