One platform. Every discipline. Your infrastructure.
Risk, compliance, governance, audit and continuity — connected end to end, deployable as managed cloud or entirely inside your own data centre.
Five questions, in the order a board asks them.
Numbers that explain themselves. The health score is built from the evidence underneath it — and every count opens the list behind it.
38 of 47 risks at or under tolerance
112 of 175 operating controls effective or partially effective
421 of 601 applicable clauses backed by a working control
70 of 250 tracked deadlines past due
Example data · every count opens the list behind it
- 1
Are we inside the boundary we set?
The health score, and one queue of what needs a decision or is overdue.
- 2
Where are we outside appetite?
The risk matrix on your own scale, and top exposures with owner, appetite position and control count.
- 3
Are the controls actually working?
Effective, partial, ineffective or never tested — with tests overdue and failed.
- 4
Are we compliant, and can we prove it?
Per framework: assured, mapped but not tested, failing, no control — beside the percentage somebody marked compliant.
- 5
What happened?
Incidents with the regulator-reportable count, KRIs as RAG, and what moved in the period.
A control that is mapped but never tested earns nothing. A measure with no data is left out and says so — never scored as 100%.
Not a form builder. A real lifecycle for every discipline.
A statement, not a title
Cause, event and consequence; impact scored per dimension; inherent → residual → target on your own matrix; appetite per risk category. Every score change carries a written rationale.
Full Basel toolkit
RCSA campaigns, KRIs with defined formulas, amber/red escalation to a named owner and live data feeds, and the loss database — mapped to the seven Basel event types.
Basel III SMA capital
Structured scenario workshops feeding a Standardised-Approach operational-risk capital calculation — the fourth leg of Basel ORM, computed for you.
Monte Carlo simulation
Ten-thousand-iteration simulations turning a scenario into a P10 / P50 / P90 loss-exposure curve. Boards understand money, not colours.
SR 11-7 validation
Inventory and independent-validation lifecycle for IFRS 9 ECL, credit-scoring, AML and AI/ML models — with materiality and overdue-validation tracking.
From assets to a hierarchy
Generate risks from your asset register into a review queue — forty servers running Payments become one candidate, not forty risks — then roll them up enterprise → category → scenario.
Seventeen standards, one click
ISO 27001, NIST CSF 2.0 and SP 800-53, PCI DSS 4.0, SOC 2, Basel, Shariah and four SBP packs — 1,333 clauses, and control frameworks bring their controls with them.
Map once, prove everywhere
Suggested clauses for the controls you wrote, crosswalk suggestions between frameworks, and a Statement of Applicability exported to XLSX or PDF.
The annual cycle
Process universe → risk-control matrix → design & operating tests → deficiency evaluation, from simple deficiency to material weakness.
Universe to follow-up
Risk-based audit universe, engagements, working-paper procedures and findings — tracked enterprise-wide until every one is closed.
Tested, reviewed, proven
A workpaper per test — period, sample, exceptions, conclusion, evidence — approved by a second person before it moves effectiveness. A failed test opens an issue by itself.
Your tools feed the proof
SIEMs, identity platforms and scripts post control-check results; each lands as evidence and a test run, and a failure raises an alert — never a rating on its own.
Draft to acknowledgment
Draft, review, approve, publish — four-eyes at each step — with the approving committee, periodic reviews and acknowledgement tracked by role.
Meetings to board packs
Committees, meetings and decisions — and a board pack (PDF and spreadsheet) generated from the live register, automatically before each meeting.
Confidential intake
Anonymous disclosure intake with tokenised case references, triage and investigation case files through to a substantiated outcome.
Conflicts & conduct
Periodic conflict-of-interest, gifts, personal-account-dealing and outside-employment declaration campaigns with reviewer sign-off.
Authority matrix
A documented delegation-of-authority matrix and dual-control rules — who may approve what, by role and amount band.
Green Banking
Green Banking Guideline tracking and environmental risk ratings for credit and vendor exposures.
Detection to closure
Severity, a minute-level timeline, MTTD/MTTR and links to the risks, assets and controls involved — with the regulator’s notification deadline counting down.
Plans & exercises
Continuity plans with a recurring exercise calendar and tested recovery strategies — sign-off tracked, never assumed.
RTO / RPO / MTPD
Structured BIA capturing recovery objectives and single points of failure, feeding directly into continuity plans.
One CAPA register
Every finding from every module lands in one shared issue register with owners, due dates and a common lifecycle to closure.
Findings to patch
Scanner findings with severity-driven remediation SLAs (critical in 7 days) and a patch-deployment pipeline through to deployed.
Enforced four-eyes
Maker-checker where the requester can never approve their own request, each checker votes once, and every rejection carries a reason — decided in the app or from the inbox.
Work finds the person who owns it.
First line, second line, internal audit and the board each see their own work — and act on it without hunting through modules.
One list per person
Decisions waiting for you, what you own that is due in the next fortnight, and policies to acknowledge. First-line staff land here, not in a sidebar of every module.
Addressed, not broadcast
Each alert goes to the record’s accountable owner or role and opens the record itself. E-mail digests carry only your own items.
Approve from the inbox
Approve and Reject buttons in the e-mail, on single-use 72-hour links, under the same four-eyes rules. Switch it off where policy requires two-factor for every approval.
A sidebar for your job
People see only what their permissions allow, with groups opened for first line, second line, internal audit or the board.
Every number opens its list
A dashboard count opens its register filtered to the same rows. Bulk-set owners, dates and status, with a summary before anything changes.
Live in five steps
Locale, frameworks and modules — pre-selected for your institution type, with Shariah governance for an Islamic bank — then invite the team.
Every core record, examiner-deep.
What the examiner opens — and what they find inside it.
The regulator’s clock, to the minute
A timeline in minutes, the notification deadline with a live countdown and an on-time or late badge, and MTTD/MTTR. A data breach opens its breach record; a cost becomes a loss event.
Closed only when proven
Linked to the risks, controls, clauses and vendors they concern. Closing needs an independent validation with evidence, and every due-date move is logged.
Defined, escalated, fed
Definition, formula and data source; higher-, lower- or within-range thresholds; amber and red escalation to a named person and role; readings posted by your systems.
Tiered, not guessed
Due diligence, data residency, fourth parties and certifications with expiry alerts. An eight-question tiering questionnaire sets the inherent tier — overriding it needs a reason.
Approved, superseded, acknowledged
An approving committee, an effective date, the policy it supersedes — retired automatically on publication — and who in each role has acknowledged it.
Every record explains itself
Each record opens as a dossier: a plain-language headline, a summary band, open points each with a link to fix it, and the sign-off trail alongside.
See NexusLine with your frameworks loaded.
Book a walkthrough and see how NexusLine unifies your risk and compliance function in a single system — on the infrastructure you choose.
nexusline.io · info@nexusline.io · SaaS & on-premise