A governance, risk management, and compliance (GRC) computer system is provided that includes at least one processor, a user input device, and a storage system that stores meta-model. The meta-model includes at least one process element, a plurality of dynamic risk elements, and a plurality of dynamic control elements. The risk meta-model is loaded from the storage system. Input is accepted from the user input device for creating a new dynamic risk model based on the loaded extended risk meta-model. At least one process element is added to the new dynamic risk model based on user provided input and the extended risk meta-model. A first dynamic risk element is added from the plurality of dynamic risk elements based on user provided input. A risk type of the first dynamic risk element is determined based on user provided input.