Sign in
Set up for Compliance

AI for insights and analytics

AI analytics for compliance

A register with 640 obligations reports 92 percent control coverage; counted strictly, with an owner and a test in the last cycle, it is 73 percent, and twelve of the unmapped obligations are rated high. AI analytics reads the register, the testing log and the issue tracker, and answers the head of compliance: where is coverage thin, and who is sitting on findings.

Ask it in your own words

These are the questions compliance teams ask. Each one maps to a measure our tools compute from your files. The AI model chooses the measure and explains the result; the arithmetic is done by our code, and every total is checked.

The questionThe measure behind itWhat comes back
What is our real control coverage?Obligation to control coverageObligations with a mapped, owned and tested control, by rating and business unit, against the headline figure.
Which regulatory changes have no control yet?Regulatory change coverageChanges received in the period against controls mapped, with the high-rated ones listed.
Which tests are overdue?Testing on scheduleControls tested within their cycle over controls due, by owner, with the overdue list.
Whose findings are ageing?Issue ageing by ownerOpen findings by owner and age band, with the ones past their target date.
Who has not completed required training?Training against role requirementCompletion against the requirement for each role, by unit, with the overdue names for the unit head.
Where is evidence missing?Evidence completenessControls tested with complete evidence over controls tested, by owner.

A conversation, with the figures

Every figure below was computed by a tool from the rows and checked before it was shown. The lines sum; the percentages match; each line opens to the rows that make it.

How many high-rated obligations have no tested control?

28 high-rated obligations have no control that is mapped, owned and tested in the last cycle, across 3 business units. Payments unit accounts for 14 of them, 50% of the total.

Payments unit1450% of the total
Lending unit932% of the total
Wealth unit518% of the total
The 3 lines sum to280 unexplained

Which ones in payments?

3 obligations account for 14 of the 14 gaps in the Payments unit, 100% of them. Each arrived through regulatory change in the last year and was never mapped to a control.

Payment services regulation update7received 8 months ago; no control mapped
Sanctions screening standard4control mapped; no owner
Operational resilience rule3owner assigned; never tested
These 3 are14100% of Payments unit

What goes on the committee agenda?

The twelve, with an owner and a date each. The head of compliance reports coverage by the strict definition from now on, beside the old figure, until the two agree.

Payments compliance leadMap and assign controls for the seven payment obligationsThis month
Control ownersTest the three resilience controlsThis cycle
Head of complianceReport strict coverage to the committeeQuarterly
What is our real control coverage?Which regulatory changes have no control yet?Which tests are overdue?Whose findings are ageing?

The measures behind the answers

Each measure has one formula, one source and one meaning. They are computed per business unit and owner and in total, and every one carries an identity that must hold before it is shown.

MeasureFormulaFromWhat it tells you
Obligation to control coverageObligations with a mapped, owned and tested control ÷ obligations, weighted by risk ratingObligations register; control libraryObligations with nothing behind them
Regulatory change coverageNew or changed obligations with a control mapped within the stated days ÷ new or changed obligationsRegulatory change log; control libraryWhether the register keeps up
Testing on scheduleControl tests completed by due date ÷ tests due, by risk ratingTesting scheduleControls that slipped, highest risk first
Failure rate and repeat failuresTests failed ÷ tests completed; failures on controls that failed the prior testTest resultsRemediation that did not work
Issue ageing by ownerOpen issues past remediation date, by owner, days overdue, number of extensionsIssues logWhere findings wait
Training against role requirementRequired modules completed and in date ÷ required modules, per person, by unitLearning system; role matrixWho is overdue, and where
Incident reporting against activityIncidents reported per unit of activity, by business unit, against the firm medianIncident log; activity volumesUnits that report nothing
Policy attestationStaff attested within the window ÷ staff required, by policy and unitAttestation recordsPolicies nobody has confirmed reading
Time to close findingsMedian days from finding to verified closure, by severity and sourceIssues logWhether serious findings close faster than minor ones
Evidence completenessTested controls with evidence attached and dated ÷ tested controlsTesting recordsAssertions that could not be shown to a regulator

Each measure is worked through, with the export it comes from and what to drop, in KPIs for compliance teams.

What the AI model does, and what our tools do

The AI model chooses the measure

From your question and the measures declared for compliance, the model picks the one that answers it, and the period and comparison the question implies.

Our tools do the arithmetic

Deterministic code reads the rows, computes the measure, and checks the identities below. The same question on the same data gives the same answer, every time.

The AI model explains, and cites

The AI model writes the sentence around the result, naming the business unit or account behind it. It states no figure that is not in the result, and every figure links to its rows.

The identities that must hold

CoverageObligations = mapped, owned and tested + mapped with a gap + unmapped
TestingTests due = completed on time + completed late + overdue
IssuesOpening issues + raised − closed = closing issues
TrainingRequired = completed in date + expired + never completed

What it reads

The exports compliance teams already produce. Column names are mapped once and the mapping is reused. A file is the way in; scheduled delivery and connections to your systems come with the plan, and every source is listed here.

  • Obligations register
  • Control library
  • Regulatory change log
  • Testing schedule
  • Test results
  • Issues log
  • Learning system
  • Role matrix
  • Incident log
  • Activity volumes
  • Attestation records
  • Testing records

Who owns each answer

An answer is a list with an owner and a cadence, or it is a chart nobody works.

MeasuresOwnerCadence
Issue ageing; testing on scheduleIssue and control owners; head of complianceMonthly
Training; attestationUnit headsMonthly
Obligation and regulatory change coverageHead of complianceQuarterly, and on each regulatory change
Incident reporting against activity; repeat failures; evidenceHead of compliance; risk committeeQuarterly

Questions compliance teams ask about AI analytics

What is the strict definition of coverage?

An obligation counts as covered only when a control is mapped to it, that control has a named owner, and it was tested within its cycle with evidence. Each condition is a column in your files; the tool applies all three and shows the count at each step, so the difference from the headline figure is explained line by line.

Can it read our GRC export?

Yes. It needs the obligation register, the control library with owners, the testing log and the issue tracker, in whatever export your platform produces. Column names are mapped once. If a field is missing, such as owner, the tool says the condition cannot be evaluated rather than assuming it passed.

Does it assess risk?

No. Ratings come from your register. The tool counts, joins and lists; it never rates an obligation or judges a control. The judgement stays with compliance, made from figures that are complete.

How does it help with findings?

Issue ageing by owner is a list: each open finding, its owner, its age and its target date, ranked by overdue days. It goes to the committee as it is, and the same question next month shows what closed.

See it on your data

Bring a few thousand rows. The data map opens next, every column mapped once, and the first question is answered in minutes. Free, in your browser, no account.