Packaging / Modules
The five modules
Each module works on its own or alongside the governance core, so you can start with one and add the rest when you are ready. A module you license appears in your navigation from the next sign-in.
Supplier Due Diligence & Third-Party Risk
The suppliers a firm depends on carry risk into it, and the reviews meant to catch that risk tend to live in a separate spreadsheet from the register they are supposed to inform, and the two rarely agree.
The module keeps a register of the suppliers you depend on, tiered by how much you rely on them, with the reviews you run on them and the assurance attestations they give you (a SOC 2 report, for example) tracked to expiry and mapped to your controls. A review is signed off by the second line (never by the person who ran it), in the same way the core treats a breach response or an action closure.
- Third party register and tiering
- Supplier due diligence reviews
- Certifications and expiry
- Risk linkages and concentration
Obligations Management
A firm's contractual commitments are usually spread between a contract folder and a spreadsheet, so the record of who each is held with, what it requires and when it next falls due is hard to find when it matters.
The module captures them in one live register, each with an owner and tracked to its deadline, together with the organisations they are held with and the evidence that each one was met.
- Obligations register
- Organisations
- Satisfaction history
- Obligation calendar
ICARA
For MIFIDPRU investment firms the ICARA is an intensive annual exercise, rebuilt each year from risk, control and indicator material that is kept somewhere else for the rest of the year.
The module turns it into a repeatable process driven by the core platform, so the assessment draws on the register, controls and indicators you already maintain rather than on a fresh collection each year.
Operational Resilience
A resilience picture built in a standalone tool is out of date the day after it is built, because the suppliers, risks, indicators and controls it depends on live elsewhere and move on without it.
The module holds your important business services, the impact tolerances the board has set for them and where each service stands now, derived from the suppliers, risks, indicators and controls you already maintain, so nothing is re-keyed. A scenario test traces a disruption through the dependencies to a verdict against each tolerance, and the actions it raises land in the same remediation view as everything else.
Customer Oversight Portal
Corporate customers ask how their risks are being managed, and the answer is usually assembled by hand each time somebody asks.
The module gives each corporate customer a secure view of the assurance material you choose to share with them, curated by you and drawn from the record the platform already keeps.