All these three type of controls need to be documented in the central GRC tool. we called this set of controls “central report.” In other words: all controls in the attached spreadsheet that have the label ‘central report’ in the column Significance are expected to be documented and tested in the GRC tool.