Back to overview

Developing a GRC and ITSM solution

User Tutorials Published on 16.01.2026

Tutorial: Building a GRC and ITSM Solution

Goal of this tutorial: We will show you how to create a professional solution for Governance, Risk & Compliance (GRC) and IT Service Management (ITSM) using INtex Project X.

1. Basics & Terms

GRC (Governance, Risk & Compliance)

Governance: Corporate management and control.

Risk Management: Identification and treatment of risks.

Compliance: Adherence to laws and guidelines.

In this module, we manage risks, conduct audits, and control policy documents.

ITSM (IT Service Management)

The management and delivery of IT services.

Incident Management: Incident resolution (Tickets).
Change Management: Controlled changes to IT.
Asset Management: Management of IT systems.

2. Data Structure (Creating Tables)

Create the following tables under Settings > Table Definition.

1. Risks (Risk Register)

Central directory of all corporate risks.

Field Name	Type	Configuration / Note
Title	TEXT	Title Field
Description	TEXTAREA
Category	SELECT	Value list: Strategic, Operational, Financial, IT, Compliance
Probability	NUMBER	1 (Low) to 5 (Very High)
Impact	NUMBER	1 (Low) to 5 (Very High)
Risk Score	FORMULA	Formula: `{probability} * {impact}`
Status	SELECT	Value list: Identified, Analyzed, With Measures, Closed
Owner	LOOKUP	Link to `user` (or Employee table)

2. IT Systems (Asset Management)

Inventory list for servers, software, and services. Serves as a basis for tickets.

Field Name	Type	Configuration / Note
System Name	TEXT	Title Field
Type	SELECT	Server, SaaS, Client, Network
Criticality	SELECT	Low, Medium, High, Critical
Location	TEXT
Owner	LOOKUP	Link to `user`

3. Incidents / Tickets

Recording of incidents and service requests.

Field Name	Type	Configuration / Note
Subject	TEXT	Title Field
Description	TEXTAREA
Affected System	LOOKUP	Link to `IT Systems`
Priority	SELECT	Low, Medium, High, Critical
Status	SELECT	New, In Progress, Waiting, Resolved
Assignee	LOOKUP	Link to `user`
Due Date	DATETIME	SLA target time

Change Requests

Title (TEXT)
System (LOOKUP to IT Systems)
Type (SELECT: Standard, Normal, Emergency)
Approver (LOOKUP to User)
Status (SELECT: Requested, Approved, Implemented, Review)

Audits

Title (TEXT)
Date (DATE)
Auditor (TEXT or LOOKUP)
Result (TEXTAREA)
Report (FILE)

Policies (Guidelines)

Name (TEXT)
Version (TEXT)
Valid until (DATE)
Document (FILE)

3. Features & Implementation

Use the built-in tools to turn the data structure into a living application.

Custom Views

Create specialized views for different workflows:

Kanban Board for Tickets:
Create a view for the table Incidents. Select Status as the grouping field. Enable the "Kanban Field" (Status) in the table definition.
Calendar for Audits:
Create a view for Audits. Since the table has a date field, the system automatically offers a calendar view.
"My Open Risks":
Create a view with filter: Owner = [USER] and Status != Closed.

Custom Charts (Analysis)

Visualize the GRC situation:

Risk Matrix (Heatmap replacement):
Use a Bar Chart for the table Risks. X-Axis: Category, Y-Axis: Average (AVG) of Risk Score.
Ticket Volume:
A Donut Chart for Incidents, grouped by Status (Aggregation: Count).
Assets by Criticality:
A Pie Chart for IT Systems, grouped by Criticality.

Custom Print Layouts

Create PDF reports directly from the records:

Audit Report:
Create an HTML layout for the table Audits. Use placeholders like {title}, {date}, and {result} to generate a formatted report.
Change Request Form:
A layout for Change Requests that can be submitted for signature. Include fields like {description}, {risk_analysis}, and signature fields.

Custom Buttons & Generators

Automate processes with the push of a button:

"Approve" (Change Management):
Create an "Approve" button. Use the "Change Field Value" generator to set the Status to "Approved". Condition: Only visible if Status = Requested.
"Escalate" (Incident Management):
A button that sets the Priority to "Critical" and sends an email to the IT Manager (via Email Generator).
"Complete Audit":
A button that writes the current date into the completed_on field.

Custom Queries (SQL)

For complex reports across table boundaries:

SELECT 
  s.name AS System,
  COUNT(i.id) AS Ticket_Count,
  MAX(i.created_at) AS Last_Ticket
FROM it_systeme s
LEFT JOIN incidents i ON i.system_id = s.id
WHERE i.status != 'Resolved'
GROUP BY s.id
ORDER BY Ticket_Count DESC

This query shows IT systems with the most open issues – a key indicator for risks.

Custom Snippets (Code)

Advanced logic with PHP snippets (e.g., validate_risks_snippet.php):

Automatic Risk Assessment:
If Probability * Impact > 20, automatically set Status to "Critical" and send a warning email to the Compliance Officer.
SLA Calculation:
When saving a ticket: If Priority = Critical, automatically set the Due Date field to NOW + 4 hours.

Conclusion

With these building blocks, you have created a fully functional GRC and ITSM platform that not only stores data but actively supports and automates processes.