One Platform.
Every Line of Defence.
XpediOo GRC & ERM Suite unifies Third-Party Risk, Internal Audit, Enterprise Risk, Compliance, Governance, Privacy, Business Continuity, Cybersecurity and Model Risk into a single AI-native system of record — replacing spreadsheets, email chains and disconnected point tools.
An AI-Native Architecture, Built for Sensitive Data
Every module shares one data model, one AI engine and one evidence store — so risk, compliance, audit and vendor data reinforce each other instead of living in silos.
Platform Architecture
- Unified data model — risks, controls, vendors, findings, policies, obligations, incidents and evidence are related records, not disconnected spreadsheets
- Bring-your-own AI provider — OpenAI, Anthropic, Google AI, NVIDIA, DeepSeek, Amazon Bedrock, Meta Llama and custom endpoints, with connection testing before go-live
- Model Context Protocol (MCP) server exposes live risk, compliance, audit, vendor and policy data — plus full risk CRUD — to approved AI clients like Claude Desktop, Cursor and Windsurf
- Evidence-first design — uploaded contracts, questionnaires, SOC 2 reports and audit workpapers are read by AI, not just stored
- Role-based, framework-aware — 100+ regulatory and standards frameworks modelled natively across audit, compliance, policy and cyber modules
Security, Data & Deployment
- Authenticated by default — every API sits behind session-based authentication; exceptions like a vendor's one-time questionnaire link are narrowly scoped, tokenised and expire on submission
- Centralized evidence storage — contracts, SOC 2 reports, audit workpapers and questionnaire attachments live in a dedicated object-storage layer with per-record linkage
- Administrator-controlled AI — LLM Settings gives full control over which provider and model power every AI feature, with masked credentials and connection testing before go-live
- Governed AI-to-data access — the MCP server is protected by its own API key and exposes a documented, filterable tool catalog rather than open database access
- Role-aware by module — Identity Governance provides permission-matrix role modelling, business-unit segmentation and MFA-enrolment tracking
- Deploys as one application — a single, centrally-hosted web app with one system of record; no per-module install or data-sync job to maintain
Supported Frameworks, by domain
Explore a selection of our 100+ supported regulatory frameworks and standards. Select a badge to see its scope, practical uses and advantages.
Privacy
Personal data and privacy management.
Cybersecurity
Security management, baselines and threat coverage.
Governance
Internal control, risk and organizational governance.
AI
AI management, risk and governance.
Pharma & GxP
Medicine manufacturing, API quality, pharmaceutical quality systems and electronic records.
Manufacturing
Quality, automotive and aerospace, worker safety, environment and industrial OT security.
One workspace for every risk decision
Replace disconnected registers and point tools with a live, AI-powered view of enterprise risk, compliance, cybersecurity, and board-level performance.
Executive GRC Dashboards & Analytics
See total enterprise risk, compliance rate, open audit issues, vendor exposure, risk distribution, and board KPI scorecards at a glance.
Enterprise Risk Register
Generate and manage risk registers with AI-assisted scoring across inherent, residual, and target risk.
Residual Risk Calculator
Make risk exposure visible by modelling likelihood, impact, controls, and real-world residual risk.
Enterprise Compliance
Track compliance items, owners, due dates, frameworks, status, and evidence from one workspace.
AI Compliance Templates
Import AI-generated templates for the frameworks and industry requirements your organisation needs.
Cybersecurity GRC
Connect cybersecurity assets to criticality, risk tiers, ownership, and remediation workflows.
20+ Modules Across Six Suites
Every module below lists capabilities in two tiers. Select a suite to expand its modules.
Third-Party Risk Suite
AI-accelerated vendor risk, contracts and due diligence.
Third-Party Risk Suite
AI-accelerated vendor risk, contracts and due diligence.
Vendor Register & Assessments
Central vendor register with onboarding, tiering, due diligence and questionnaire management for every third party.
- AI-generated, unlimited vendor questionnaire questions layered on predefined controls, including targeted AI/ML governance and cloud supply-chain prompts
- AI Vendor Assessment reads actual questionnaire responses to produce risk level, score, and a Security/Compliance/Financial/Operational breakdown
- AI-generated due-diligence reports covering Executive Summary, Risk Analysis, Compliance Status, Findings and Recommendations
- Nine prebuilt compliance questionnaire templates (TPRM, InfoSec, Financial Due Diligence, ISO 27001, SOC 2, SOX, PCI-DSS, HIPAA, NIST CSF) with AI expansion
- Vendor CRUD with tier, risk level, status, data-access level, country, frameworks, owner and notes
- Search and multi-filter by category, risk, status and tier; dashboard charts for vendor distribution and risk posture
- Assessment and questionnaire-response records with completion tracking
Concentration Risk Analyzer
Identifies single-source, spend, geographic and revenue-at-risk vendor dependencies before they become crises.
- Per-exposure and portfolio-level AI analysis producing executive summary, key findings, regulatory exposure and mitigation plans
- Automated warnings for single-source vendors with no alternatives and high-criticality vendors with no supporting evidence
- Exposure register with criticality tier, dependency level, substitute readiness, spend % and revenue-at-risk %
- Spend-vs-revenue-impact bubble chart and risk-rating distribution with configurable thresholds
Contracts, SLAs & Supplier Scoring
Contract lifecycle, live SLA monitoring and a seven-domain weighted supplier scorecard.
- AI-powered contract obligation analysis and compliance scoring with renewal/expiry alerts and breach tracking
- AI root-cause analysis for SLA breaches with remediation guidance before penalty thresholds trigger
- AI-weighted supplier ratings across Financial, Cybersecurity, Operational, Reputational, Geopolitical, ESG and Compliance domains
- Contract register (MSA/SLA/NDA/DPA/SOW/licence) with renewal terms and breach detail
- SLA metric register with target vs. actual tracking
- Supplier scorecard with per-domain scores, trend and review cadence
Third-Party Risk Register & Assessment Templates
Formal inherent/residual risk register and repeatable vendor assessment methodology.
- AI-powered risk assessment and mitigation planning across ten risk categories, with inherent-vs-residual scoring
- Structured control scoring across Information Security, Data Privacy, Business Continuity, Compliance, Financial Viability and Subcontractor Management
- Risk register with likelihood/impact, treatment, owner and control effectiveness
- Six assessment templates (Standard, Enhanced Due Diligence, Critical Vendor, IT/Cyber, Financial Stability, ESG)
Vendor Document Repository & Self-Service Portal
A shared evidence store and a no-login vendor portal that turns due diligence into self-service.
- AI reads uploaded evidence and flags whether it meets due-diligence expectations, with a one-click compliance check
- AI generates a fully custom questionnaire from vendor context and emails a unique, no-login portal link
- Automatic response scoring, AI risk review and AI evidence-compliance scanning
- Central document repository with category, expiry date and status
- Questionnaire register with due dates, auto-score and submitted/reviewed state
- Notification centre for due/expiring items, breaches and missing evidence
Internal Audit Suite
Risk-based, IIA-aligned audit management, end to end.
Internal Audit Suite
Risk-based, IIA-aligned audit management, end to end.
Audit Planning & Universe
Plan, prioritise and track the organisation's full population of auditable entities.
- AI Risk-Based Audit Scoring evaluates inherent risk, control environment, last-audit rating, complexity and regulatory exposure into a composite score and priority
- AI-designed sampling methodology recommends sample size, stratification and rationale
- Audit Universe Builder with entity type, department, owner, data classification and scope flag
- Audit register spanning 17 frameworks with KPI cards for planned/in-progress/completed audits
Fieldwork, Testing & Evidence
Execute fieldwork with structured, evidence-backed workpapers instead of unstructured notes.
- One-click AI Compliance Report reads uploaded evidence and produces a compliance score, executive summary, findings, root cause and remediation
- AI-recommended framework controls with AI-generated per-control checklists
- Control Testing Sheet, Fieldwork Tracker and Evidence Collection Log with due/received dates and status
- Evidence upload with automatic RAG ingestion; compliance progress bar and risk-level badges
Findings, KPIs & Remediation
Turn findings into accountable, board-visible actions and track audit-function performance.
- AI Draft Findings generates root cause, recommendation, regulatory reference and management response
- AI Add-KPIs suggests IIA-aligned KPIs aware of what's already tracked, for bulk addition
- AI Management Action Plan drafting turns a finding into structured actions and success criteria
- Findings register with severity, status, repeat-finding and board-reported flags
- KPI Dashboard across Efficiency, Quality, Timeliness, Coverage, Risk Management and Stakeholder categories
- Issue Aging Dashboard and Management Action Plan register
Enterprise Risk Management Suite
From risk register to predictive risk intelligence.
Enterprise Risk Management Suite
From risk register to predictive risk intelligence.
Enterprise Risk Management & ERM Suite
Executive risk-universe view plus emerging, scenario, strategic and dependency risk registers.
- Configurable risk-appetite statements and tolerance thresholds with automatic breach monitoring; scenario stress tests apply likelihood/impact shocks
- Bow-tie mapping of causes → preventive controls → top event → mitigating controls → consequences
- AI scan for emerging risks, AI scenario analysis with early-warning indicators, AI dependency auto-mapping and velocity alerts
- Risk-universe rollup with residual-risk distribution and category averages
- Emerging, strategic and dependency risk registers with signal source, velocity and KRI linkage
Operational, Model & ESG Risk
Day-to-day operational risk capture through to AI/ML model governance and ESG risk.
- AI risk-template generation tailored by industry/category with AI-recommended controls and bulk import
- AI model-risk suggestion generation with performance/drift monitoring for AI/ML model inventories
- AI ESG template generator and one-click checklist generation across Environmental, Social and Governance risk
- Operational risk register with automatic risk-level classification from numeric scoring
- Model inventory dashboard with drift and validation tracking
- ESG register filterable by E/S/G with checklist workflow
Risk Analytics, Metrics & KPI/KRI Suite
Predictive analytics and a Kaplan & Norton-aligned performance and key-risk-indicator hub.
- Predictive risk trajectory with confidence values, model recommendations and forward-looking alerts
- AI scorecard insight generation across Balanced Scorecard perspectives with automatic BSC achievement and KRI breach calculations
- Risk Trends, Predictions, Correlations and Model-comparison tabs with risk-velocity analysis
- Balanced Scorecard across Financial, Customer, Internal Process and Learning & Growth
Compliance Management Suite
Framework compliance, obligations and remediation on autopilot.
Compliance Management Suite
Framework compliance, obligations and remediation on autopilot.
Enterprise Compliance & Obligations
Framework-based compliance requirements, evidence and accountable obligation tracking.
- AI-generated compliance requirements/templates by framework and industry vertical with bulk import
- Obligation-centric tracking surfaces due-date and evidence gaps for recurring compliance work
- Framework/vertical/status filters across a full compliance requirement register
- Obligation register with jurisdiction, framework, frequency, priority and applicability
Non-Compliance Incidents & Remediation
Investigate incidents and drive remediation to verified closure.
- AI incident analysis suggests severity, root cause, regulatory impact, containment and corrective actions in one click
- AI-assisted remediation turns findings into structured actions, milestones and verification content
- Incident register with regulator-reporting and escalation KPIs
- Remediation register with implementation/verification evidence and effectiveness result
Compliance Status, Calendar & Change Log
Executive compliance health, deadline management and regulatory-change tracking.
- Automatic urgency calculation for deadlines within 30 days and automated overdue/critical KPI identification
- AI-assisted regulatory-change analysis converts a change notice into accountable follow-up actions
- Framework score cards (SOX, ISO 27001, GDPR, HIPAA, PCI DSS, NIST) with Excellent/Good/Needs Attention/Critical thresholds
- Compliance calendar and regulatory change register with impact assessment
Governance & Policy Suite
Governance, policy lifecycle and cross-framework mapping.
Governance & Policy Suite
Governance, policy lifecycle and cross-framework mapping.
Governance Suite
Delegation of authority, governance scorecards and board-level benchmarking.
- AI analysis of delegations and governance scorecards persisted back to the record
- Benchmarking against ASX CGC, King IV, UK Corporate Governance Code and OECD Principles
- Delegation-of-authority register with financial limit, approval level and review frequency
- Governance performance scorecard across Board Composition, Risk Governance and Compliance Oversight
Corporate Policy & Regulatory Crosswalk
Generate, upgrade and cross-map enterprise policy against regulatory frameworks.
- AI policy generation and upgrade, plus AI text extraction from uploaded documents
- AI crosswalk generator compares source/target frameworks and produces evidence-backed mappings for bulk import
- AI-generated cross-framework mappings exposing direct/partial/no-coverage gaps automatically
- Categorized policy library with governance/ownership, scope, controls and evidence/testing tabs; PDF/Word export
- Regulatory Crosswalk register and Policy Management lifecycle register with version and review dates
Corrective Action Register (CAR)
Manage corrective, preventive and systemic actions from finding to effectiveness verification.
- AI Portfolio Insights analyzes the entire CAR portfolio
- Per-record AI analyzer generates root-cause analysis, action plan, milestones and containment applied directly to the form
- CAR register with source, severity, root-cause category, milestones and overdue detection
Resilience, Privacy & Cyber Suite
Incidents, privacy, continuity, financial controls and cyber GRC.
Resilience, Privacy & Cyber Suite
Incidents, privacy, continuity, financial controls and cyber GRC.
Incident Management & Identity Governance
Incident-response governance, CAPA and IAM controls in one hub.
- AI CAPA generation from an incident description produces title, root-cause method, actions, assignee, priority and regulatory linkage
- Permission-matrix role modelling with built-in identity-provider connection testing
- CAPA register with open/closed status and due-date ageing; role, business-unit and identity-provider registers with MFA-enrolment tracking
Privacy Suite (GDPR/CCPA)
Four-module privacy operations: breaches, ROPA, retention and privacy risk.
- AI breach analysis determines risk score and notification-required decision from severity, subjects and breach type
- AI processing assessment evaluates legal basis and international transfers to flag DPIA requirements
- AI retention recommendations and AI privacy-risk assessment with GDPR article mapping
- Data Breach Log (GDPR Art. 33/34), Processing Inventory/ROPA, Retention Schedule and Privacy Risk Register with heatmap
Business Continuity & Financial Controls
Continuity planning and financial control-effectiveness registries.
- AI continuity-plan generator, AI control/procedure recommendations with maturity output and one-click PDF/Word export
- Financial-controls KPI dashboard surfaces effective controls, deficiencies and high-risk controls
- Continuity-plan register with objectives, procedures and status; financial-controls register with effectiveness tracking
Cybersecurity GRC & RBI Model Risk Management
Enterprise cyber-GRC and AI/ML model risk governance aligned to RBI's 2026 guidance.
- AI asset-criticality scoring (ISO 27005/NIST SP 800-60), AI risk narratives, AI ISO 27001 assessments with Annex A mapping and Treat/Transfer/Tolerate/Terminate recommendations
- AI Shadow-IT detection, AI vendor scoring and AI vulnerability triage/clustering/executive summaries
- AI model-inventory generator under RBI MRM Guidance 2026, batch-generating up to 100 models with tiering and per-model compliance assessment
- CMDB asset register with CSV import/validation; vulnerability dashboard (Total, P1 Critical, Actively Exploited, Remediated)
- Model registry with methodology, tier and regulatory metadata
AI Platform Layer
The shared intelligence layer every suite above draws on.
AI Platform Layer
The shared intelligence layer every suite above draws on.
Document & Content Intelligence
Turns uploaded regulatory, contract, evidence and policy documents into structured GRC intelligence.
- Regulatory Text Ingestion identifies obligations, themes and affected areas with an implementation action list
- Contract AI Review produces a contract risk score /100, clause analysis, red flags and key dates
- Evidence Adequacy Scoring rates uploaded evidence /100 against a control objective with audit-readiness assessment
- Policy Gap Comparison benchmarks a policy against ISO 27001, NIST CSF, SOC 2, PCI-DSS, GDPR, ISO 31000, COBIT, CIS or DORA with a phased remediation roadmap
- Obligation Extraction pulls binding duties, deadlines and evidence requirements, flagging high-risk obligations and quick wins
- Five-tab workflow (Regulatory, Contract, Evidence, Policy Gap, Obligations) with drag-and-drop upload and severity/status badges
AI Knowledge Generation & Narrative Reporting
Converts live GRC data and meeting documents into training content, board narratives and regulatory filings.
- Generates expert Q&A training content by industry vertical and compliance topic with one-click Markdown export
- Board Report generator snapshots live risk, compliance, audit, vendor and policy data into an executive narrative
- Automated regulatory filing drafting for MAS, FCA, DORA, PRA, GDPR/ICO, SEC, FINMA and APRA
- Meeting Minutes AI Summariser extracts decisions, action items and regulatory commitments and maps them to GRC records
- Collapsible, copyable generated sections with live data preview cards; upload support for PDF/DOCX/TXT
Executive Dashboards & Program Management
Board-ready analytics and structured GRC transformation planning.
- Board Reporting dashboard computes enterprise risk score, compliance rate, control effectiveness, audit-issue resolution and vendor risk score against targets
- Enterprise Risk dashboard automatically bands risk Critical/High/Medium/Low and compares inherent vs. residual exposure
- AI capability, initiative, maturity-assessment and roadmap analysis with automatic flagging of maturity gaps of two levels or more
- GRC Overview aggregates module health scores across Operational Risk, Compliance, Audit, IT Controls, TPR and Policy Management
- Roadmap Planner with timeline/table views and completion-rate KPIs
LLM Administration & MCP Server
Centralized AI provider control and a governed AI-client gateway to live GRC data.
- Centralized configuration for OpenAI, Anthropic, Google AI, NVIDIA, DeepSeek, Amazon Bedrock, Meta Llama and custom endpoints with connection testing
- MCP server exposes filtered risk, compliance, audit, policy and vendor data — plus full risk CRUD — to approved AI clients via an API-key-secured tool catalog
- Full provider CRUD with masked API keys, activate/default selection and per-provider model defaults
Built AI-First, Not AI-Bolted-On
Legacy GRC suites added a chatbot on top of static registers. XpediOo starts from the AI layer and builds every workflow — vendor onboarding, audit scoring, policy drafting, board reporting — around it.
| Capability | Legacy GRC Platforms | XpediOo GRC & ERM Suite |
|---|---|---|
| Vendor questionnaires | Static template library, manual review | AI-generated per vendor, auto-scored, AI-reviewed evidence |
| Audit findings & KPIs | Manual drafting; fixed KPI templates | AI-drafted findings; AI-suggested, IIA-aligned KPIs on demand |
| Policy vs. framework mapping | Manual crosswalk spreadsheets | AI-generated crosswalks with evidence & bulk import |
| Board & regulator reporting | Manual compilation from multiple systems | One-click AI narrative from live risk/compliance/audit data |
| AI/ML model governance | Not natively supported | RBI MRM Guidance 2026-aligned registry with AI assessment |
| AI provider choice | Locked to a single vendor AI | 8 supported providers, bring-your-own-key, swappable anytime |
"The difference isn't that XpediOo has AI features — it's that AI removes the busywork from every register a GRC team already keeps, so analysts spend their time on judgement, not data entry."
Built for Every Seat at the Risk Table
One platform, six very different daily workflows — each accelerated by the same shared AI layer.
Chief Risk Officer
Sees enterprise risk exposure, appetite breaches and stress-test outcomes in one view, with AI-drafted board reports replacing manual data compilation before every risk committee.
Chief Compliance Officer
Tracks framework compliance rates, obligations and regulatory change in real time, with AI-generated requirement templates and one-click regulatory filing drafts for MAS, FCA, DORA, GDPR and more.
Head of Internal Audit
Runs a fully risk-based audit plan with AI-scored prioritisation, AI-drafted findings and an AI-suggested KPI scorecard — cutting the manual drafting time behind every audit report.
Chief Information Security Officer
Uses AI asset-criticality scoring, ISO 27001 gap assessment and vulnerability triage to turn a sprawling CMDB into a prioritised, board-ready cyber-risk narrative.
Head of Procurement / TPRM
Sends AI-generated, vendor-specific due-diligence questionnaires through a no-login portal and gets an AI risk assessment the moment a vendor responds — no manual scoring spreadsheet required.
Model Risk / AI Governance Lead
Maintains an RBI MRM Guidance 2026-aligned model inventory with AI-assisted tiering, explainability and bias-testing coverage tracking for every AI/ML model in production.
AI Capability Glossary
The same handful of AI capability patterns repeat across every module — understanding them once makes the whole platform predictable.
AI Scoring
Converts qualitative inputs — a vendor profile, a control description, an incident — into a defensible, weighted numeric score. Used for vendor risk, supplier scorecards, audit prioritisation and cyber asset criticality.
AI Drafting
Generates a first-draft narrative — an audit finding, a management action plan, a board report, a regulatory filing — from structured record data, for a human reviewer to refine and approve.
AI Generation / Templating
Produces a complete starting record set — a questionnaire, a compliance requirement template, an ESG risk register, a model inventory — tailored to industry, framework or context, ready for bulk import.
AI Gap / Compliance Analysis
Compares an artefact — a policy, an evidence file, a control set — against a named framework or objective and reports coverage, gaps and remediation steps.
AI Extraction
Reads unstructured documents — contracts, regulations, meeting minutes — and pulls out structured obligations, dates, owners and risks.
AI Portfolio Intelligence
Analyzes an entire register at once, rather than one record at a time — producing an executive summary, priority actions and portfolio-level risk level.
101 Implemented Frameworks in the AI Compliance Generator
The catalog below lists every framework implemented in the AI Compliance Generator, grouped into 18 categories. The generator produces an evidence-based compliance report with a compliance score, executive summary, findings, root cause and remediation. Descriptions summarize each framework's scope.
Showing 101 of 101 frameworks
A Phased Path to Value
Organisations typically light up XpediOo in three phases, expanding from a single high-pain module to full GRC/ERM coverage.
Phase 1 — Foundation
Stand up the core register(s) for the highest-priority pain point — commonly Third-Party Risk or Internal Audit — migrate existing spreadsheets, configure the LLM provider, and connect the object-storage evidence layer.
Phase 2 — Automate
Turn on AI assessment, scoring and drafting for the live register; enable the self-service vendor portal or AI questionnaire generation; connect Compliance, Audit and Risk registers so cross-module warnings start firing.
Phase 3 — Scale
Extend to remaining suites — Governance, Privacy, Business Continuity, Cybersecurity GRC, Model Risk — activate Board Reporting and Narrative AI, and open the MCP server to approved internal AI copilots.
Industries We Serve
The framework coverage and module design reflect these sectors in particular — though configurable frameworks and AI-generated templates extend to any regulated industry.
Banking & Financial Services
RBI Model Risk Management Guidance 2026, MAS TRM, FCA, PRA, DORA, FINMA, APRA and SEC coverage fit banks, NBFCs, insurers and asset managers managing model risk, third-party risk and regulator reporting simultaneously.
Technology & SaaS
SOC 2, ISO 27001, GDPR and PCI-DSS coverage, plus the AI/ML model registry and shadow-IT detection, fit vendor-heavy, cloud-native organisations that must prove security and privacy posture to enterprise customers.
Healthcare & Life Sciences
HIPAA-aligned compliance tracking and the Privacy Suite's breach, ROPA and retention workflows support covered entities and business associates managing protected health information.
Government & Public Sector
ISO 31000/9001/14001/22301 and jurisdiction-specific privacy frameworks (UAE PDPL, PIPEDA) support agencies running formal enterprise risk and business-continuity programmes.
Manufacturing & Critical Infrastructure
Business Continuity, Financial Controls and Cybersecurity GRC modules — including CMDB-based asset criticality scoring — support operationally complex, supply-chain-dependent organisations.
Frequently Asked Questions
Common questions from evaluation teams.
Do we have to use a specific AI provider?
Can we start with one module and expand later?
How does AI avoid duplicating what we already track?
Can external AI assistants access our GRC data directly?
What happens to AI-generated content before it's saved?
Can vendors or third parties use the platform without an account?
Let's Put This to Work
XpediOo GRC & ERM Suite is ready to evaluate against your current registers, spreadsheets and point tools — through a live walkthrough, a proof of concept, or a full module-by-module RFP response.