Question 1

What is GRC software and why do Kenyan organisations need it?

Accepted Answer

GRC software is a platform that integrates governance, risk management, and compliance activities into a single system. Instead of managing Mwongozo governance requirements in Word documents, risk registers in spreadsheets, and DPA 2019 obligations in email, GRC software provides a structured digital environment where all three disciplines are connected. A compliance obligation is linked to the risks it addresses, which are linked to the controls that mitigate them, which are covered by assurance activities, creating full traceability from regulatory requirement to evidence of compliance. Kenyan organisations face a particularly complex compliance environment because multiple regulators (ODPC, CBK, CMA, IRA, SASRA, and the National Treasury) each impose distinct governance and risk management requirements. A bank listed on the NSE, for example, must simultaneously satisfy CBK Prudential Guidelines, CMA Corporate Governance Code, DPA 2019, and PFM Act requirements if it has government shareholding. Managing these overlapping obligations in spreadsheets leads to duplication, gaps, and regulatory findings. GRC software provides the single platform needed to manage all frameworks coherently.

Question 2

How does Dimeri support Mwongozo Code compliance for state corporations?

Accepted Answer

Dimeri provides a structured Mwongozo governance register that maps every governance requirement (board composition, board evaluation, risk management, internal audit, ethics and integrity, stakeholder engagement) to the specific risks, controls, and evidence in your organisation. Each Mwongozo principle is tracked with a compliance status, evidence references, and assigned ownership. When the State Corporations Advisory Committee, the Auditor-General, or a parliamentary oversight committee requests evidence of governance compliance, Dimeri provides a complete, traceable record. Board evaluation outcomes, risk committee activities, audit committee findings, and ethics officer reports are all linked to the Mwongozo requirements they satisfy. The system generates governance reports in the format that parent ministries and oversight bodies expect, replacing the manual compilation process that state corporations currently endure before every reporting cycle. For the CEO and Corporation Secretary, this means governance compliance is demonstrated through live evidence rather than retrospective document assembly.

Question 3

Does Dimeri support DPA 2019 compliance and ODPC reporting?

Accepted Answer

Yes. Dimeri provides a full DPA 2019 compliance module that covers the full lifecycle of data protection obligations. This includes ODPC registration management with renewal tracking, records of processing activities for every category of personal data, lawful basis documentation for each processing activity, data protection impact assessment (DPIA) workflows for high-risk processing, data subject access request management with statutory timeframe tracking, cross-border transfer documentation and adequacy assessments, breach incident management with 72-hour ODPC notification workflow, and evidence of technical and organisational safeguards. Each obligation is linked to a responsible data protection officer and tracked on a real-time compliance scorecard. When the ODPC conducts a compliance audit (as it has been doing with increasing frequency since 2022), Dimeri provides the structured evidence package that demonstrates ongoing compliance, not just a point-in-time registration certificate.

Question 4

Can Dimeri handle CBK prudential reporting for banks?

Accepted Answer

Yes. Dimeri supports the specific risk management and reporting requirements imposed by the CBK Prudential Guidelines on commercial banks, microfinance banks, and mortgage finance companies. The platform provides a structured risk register aligned to CBK risk categories (credit risk, market risk, operational risk, liquidity risk, technology and cyber risk, strategic risk, and reputational risk). Each risk is assessed using the likelihood-and-impact methodology the CBK expects, with control effectiveness tracking and residual risk monitoring. The system supports periodic risk reporting in the format required for CBK off-site surveillance, and maintains the complete documentation trail needed for on-site examinations, including risk appetite statements, stress test results, risk committee minutes, and control testing evidence. When the CBK issues a new prudential circular or updates its risk management guidance, Dimeri flags the impact on your existing risk register and identifies any control gaps that need to be addressed. For banks managing hundreds of risks across multiple CBK guideline categories, this eliminates the fragmented spreadsheet approach that typically leads to examination findings.

Question 5

Is Dimeri suitable for organisations regulated by multiple Kenyan bodies?

Accepted Answer

Absolutely. Many Kenyan organisations, particularly banks with government shareholding, listed state corporations, and insurance companies, must comply with multiple regulatory frameworks simultaneously. A listed bank with government shareholding, for example, must satisfy the Mwongozo Code (as a state corporation), CBK Prudential Guidelines (as a bank), CMA Code of Corporate Governance (as a listed company), DPA 2019 (as a data controller), and the PFM Act 2012 (as a public entity). Dimeri's multi-framework architecture allows you to map a single risk to every regulation it touches. A cybersecurity risk, for instance, is simultaneously tracked against CBK technology risk guidelines, DPA 2019 safeguard requirements, and Mwongozo risk management obligations. This eliminates the duplication that occurs when separate compliance teams maintain separate registers for each regulator, and ensures that a control improvement in one area is automatically reflected across all applicable frameworks. The consolidated compliance scorecard gives the board a single view of regulatory posture across all bodies (ODPC, CBK, CMA, IRA, SASRA, and the National Treasury) rather than requiring separate reports for each.

GRC Software for Kenyan Organisations

Built for how Kenya works

Mwongozo Code Governance & State Corporation Reporting

DPA 2019 Data Protection Compliance (ODPC)

CBK Risk Management & Prudential Guidelines

CMA Corporate Governance for Listed Companies

Every obligation on one register

The frameworks you answer to

Mwongozo governance compliance tracked in static Word documents that are outdated within weeks and cannot demonstrate evidence trails to the Auditor-General or EACC

DPA 2019 processing records and ODPC registration documentation scattered across department folders with no central view of compliance status or breach notification timelines

Controls that carry evidence

Common Questions

Ready to Transform Your GRC?