PENS
A register trustees can defend, kept between meetings.
A board of trustees meets a few times a year, is largely part-time, and is personally accountable for other people's retirement savings. The register cannot depend on someone remembering to update it the week before a meeting. eGRC keeps it current between meetings and shows trustees what moved.
Supervisory bodies institutions in this sector report to
- RBA Retirement Benefits Authority · Kenya
- URBRA Uganda Retirement Benefits Regulatory Authority · Uganda
- PenCom National Pension Commission · Nigeria
- NPRA National Pensions Regulatory Authority · Ghana
- FSCA Financial Sector Conduct Authority · South Africa
eGRC does not ship a fixed rulebook. Your obligations register is built from the licences, statutes and supervisory guidance that apply to you, in whichever markets you are supervised — including groups reporting to more than one.
PRESSURE
What makes this hard in your sector.
Written from what we are shown when we sit down with organisations like yours. If none of it is true for you, this is probably not the right product for you yet.
-
Trustees are part-time and the risk work is not
Between meetings the register goes quiet. Trustees then have to make decisions from a document that was current three months ago and has no record of what changed.
-
Most of the operation is outsourced
Administration, custody, investment management and actuarial work sit with service providers. Their risks are your risks, and they usually appear in your register as a single line.
-
Investment risk is reported separately from everything else
The investment report goes to one part of the meeting and the risk register to another. Nobody reconciles them, so the same exposure can be described two different ways in one pack.
-
Member data carries a real data protection duty
A scheme holds identity, salary and dependant data for thousands of members. Under the Data Protection Act that is a live obligation with an owner, not a background condition.
OUTCOME
What changes once the register is in one place.
These are the things clients in this sector set up first.
- One register covering investment, administration, service provider, compliance and governance risk
- Each outsourced provider held as a named risk with a review date and a control that is actually tested
- Statutory returns and scheme obligations on a calendar with owners, so nothing depends on a trustee remembering
- A trustee-readable pack showing position, movement and what is overdue, generated from the register
- Read-only access for trustees between meetings, with role-based access enforced through Entra ID
- An audit trail that shows a reviewer what the trustees knew and when they knew it
MODULES
The modules that carry most of the weight here.
Every tier includes the register and the audit trail. These are the ones this sector leans on hardest.
- RISK
Risk register
You keep one register, and it is always the current one.
- CTRL
Control library
You can show which control reduces which risk, and whether it worked.
- OBLG
Compliance obligations
You hold one list of what you owe your regulator, and who owes it.
- ISSU
Issues and actions
You track every finding to closure in one place, whoever raised it.
- ASSR
Assurance reporting
You build the committee pack from the register, not from memory.
- TRAIL
Audit trail
You can prove what the register said on any date, and who changed it.
See it set up for a trustee board.
Tell us your scheme size, your service providers and when your trustees next meet. We will show you the pack they would receive.