Sign inStart a trial

One register for risk, compliance and audit.

Risks, controls, obligations, policies and findings, connected — owned, dated and evidenced, for any organisation that has to be right about them.

Start a 14-day trialBook a demo

16 items3 due soon1 overdue

Any framework. One register.

Risks, controls, obligations, policies and issues side by side — each with its owner, the standard it answers to, and the state it is in.

  1. RSK-01on track

    Risk

    Key supplier fails to deliver

    ISO 31000

  2. CTL-02on track

    Control

    Quarterly user-access review

    ISO/IEC 27001 A.5.18

  3. OBL-03due soon

    Obligation

    Data protection impact assessment

    GDPR Art. 35

  4. POL-04on track

    Policy

    Information security policy

    ISO/IEC 27001 A.5.1

  5. OBL-05overdue

    Obligation

    Workplace hazard risk assessment

    ISO 45001 6.1.2

  6. ISS-06on track

    Issue

    Vendor due-diligence gaps

    Internal audit finding

  7. RSK-07on track

    Risk

    Loss of key personnel

    ISO 31000

  8. CTL-08on track

    Control

    Backup restore test

    ISO/IEC 27001 A.8.13

  9. OBL-09on track

    Obligation

    Records retention schedule

    ISO 15489-1

  10. POL-10due soon

    Policy

    Anti-bribery and corruption policy

    ISO 37001

  11. ISS-11on track

    Issue

    Segregation-of-duties exception

    Internal audit finding

  12. RSK-12on track

    Risk

    Regulatory change goes untracked

    ISO 31000

  13. CTL-13on track

    Control

    Change approval on production systems

    ISO/IEC 27001 A.8.32

  14. OBL-14on track

    Obligation

    Digital accessibility conformance

    WCAG 2.2 AA

  15. POL-15on track

    Policy

    Code of conduct

    Board approved

  16. RSK-16due soon

    Risk

    Climate-related disruption

    IFRS S2

For everyone who has to show their work.

Risk, compliance and internal audit work in the same register, and the board reads what it produces — in public bodies, corporates, non-profits and financial institutions alike.

  1. Risk

    Risk managers and CROs

    Score every risk inherent and residual against appetite, review it on its cadence, and see the controls that hold it.

    Can show: Where each risk sits against appetite, and why.

  2. Compliance

    Compliance officers

    Take obligations from any framework or regulation, give each an owner and a schedule, and file the evidence against it.

    Can show: Which obligations are met, with the evidence and the date.

  3. Internal audit

    Heads of internal audit

    Plan engagements, run fieldwork, raise findings that land on their owners, and keep the QAIP programme on file.

    Can show: A finished audit report, and a QAIP self-assessment ready for external review.

  4. Board and committees

    Directors and audit committees

    Never need to log in. They read what the register produces, drafted from live data and reviewed before it goes.

    Can show: Risk, assurance and audit reports, as PDF.

Five tools, joined into one chain.

A failed control raises an issue. An audit finding lands on its owner. An overdue obligation shows against the risk it protects. Nothing falls between modules, because there are no gaps between them.

  1. Risk

    Scored inherent and residual, against your appetite.

  2. Control

    Tested, with effectiveness that updates from every test.

  3. Obligation

    From any framework, owned, scheduled and evidenced.

  4. Policy

    Versioned, approved and acknowledged by the people it covers.

  5. Issue

    Every finding in one queue. Closing one takes a verifier.

Everything risk, compliance and audit teams open daily.

One register, one ownership map, one audit trail — under every centre.

  • Risk Center

    Register, objectives and maturity, scored inherent and residual.

  • Compliance Center

    Obligations from any framework, with evidence and analytics in one audit trail.

  • Governance

    Versioned policies, a tested control library and a single issues queue.

  • Assurance

    ERM and QAIP assessments, and the internal-audit lifecycle to a finished report.

  • Traceability

    Click a risk and watch its controls, obligations, policies and issues light up.

  • Optipluz AI

    Board narratives and cross-module answers, drawn from your own register.

Sector packs load a regulator's obligations on day one — each with the provision it comes from. The first covers AML/CFT for financial institutions.

Every cadence, on one calendar.

From the monthly control test to the five-yearly external assessment — the horizon lengthens as the line rises.

  1. MonthlyControl testsEffectiveness updates from each result.
  2. QuarterlyRisk register reviewEvery risk re-scored against appetite.
  3. AnnualPolicy attestationAcknowledged by everyone in scope.
  4. AnnualInternal audit planScoped, fieldworked, reported.
  5. Every five yearsExternal QAIP assessmentPrepared from the evidence already on file.

Event-driven duties — an incident, a finding, a regulator's request — get no date until they happen. None is given an invented one.

It reports what happened, not what looks good.

A register is worth what it can prove. Four rules Optipluz keeps, so the people who read its reports can rely on them.

  1. A duty never done is overdue.

    Nothing is scheduled comfortably far ahead to look complete. An obligation with no honest anchor waits for a person to supply its date.

  2. Every obligation cites its source.

    Each points to the provision it comes from, and a citation still being verified says so instead of passing as settled.

  3. The period, not today.

    A control test counts only toward the period it falls in, so last quarter's report still reads last quarter.

  4. Status in words, not only colour.

    Overdue and due soon each carry an icon and a label, as in the register above, so the difference survives greyscale and colour blindness.

From first register to board report.

  1. Capture

    Capture the picture

    Build the risk register, link objectives, set appetite and snapshot maturity, so your starting position is structured and comparable.

  2. Operate

    Operate compliance and assurance

    Map obligations and evidence, test controls, and run ERM and QAIP assessments, all against the same register.

  3. Brief

    Brief the board

    Let Optipluz AI draft the narrative from live data, then review committees from dashboards rather than static exports.

Plans that grow with the programme.

Every plan starts with a 14-day trial. Pricing is set with you, for your rollout.

  • Starter

    Best for smaller teams getting structured risk and compliance off the ground.

    • Risk Center: Register, Objectives & Maturity
    • Compliance Center: Obligations & Evidence
    • Dashboard, Calendar & Org Chart
    Talk to us

  • Pro

    Best for organisations running recurring reviews, assurance cycles, and AI-assisted reporting.

    • Everything in Starter
    • Assurance Center: ERM & QAIP Assessments
    • Optipluz AI Assistant for narratives & queries
    • Compliance Analytics & full audit trail
    Talk to us

  • Enterprise

    Best for large teams needing governance support, custom rollout, and priority service.

    • Everything in Pro
    • Guided onboarding & framework mapping
    • Single sign-on & advanced permissions
    • Priority support & rollout planning
    Talk to us

See it on your own organisation.

A walkthrough, a pilot, or a rollout plan. The Optipluz team replies within one business day.

Or email info@optipluz.com