Risk · Internal audit · CAPA · Evidence
One trail from a gap to its closure.
The risk register, internal audits, findings and corrective actions, and the evidence behind every control, in one workspace with one audit trail.
14-day trial · No card required · Priced per workspace, never per seat
- Risk heat map
- 5×5
- Evidence requests
- 160
- Daily checks
- 17
- Auditor access, no seat used
- Read-only
One gap, end to end
From the day a gap opens to the day it closes.
A daily check catches the gap. The internal audit raises it as a finding. Someone other than the person who fixed it signs off the closure.
- 01 Control
A.5.18 Access rights
Owned by IT Security, marked in progress at maturity 2.
In progressYour team - 02 Evidence
EV-014 Access review records
The last review on file, collected 14 March, has expired on its schedule.
ExpiredYour team - 03 Daily check
An access review in the last six months
Fails, and names the record it fails on, the day the gap opens.
FailingRegulane - 04 Internal audit
Checklist item A.5.18 tested
From a checklist generated from your Annex A controls.
TestedYour team - 05 Finding
F-01 Reviews not at the defined frequency
Raised from the checklist item, graded major.
MajorYour team - 06 CAPA
Root cause and corrective action
Quarterly reviews scheduled as tasks with an owner; the July review is uploaded.
CompletedYour team - 07 Closure
Verified and closed
By a manager who neither did the work nor is assigned it, with an effectiveness rating.
ClosedYour team
Risk register
Likelihood and impact on a 5×5, owners, treatment plans, and a daily check that every open high risk has one.
Incidents
Report and investigate, with a breach clock for CERT-In, the DPDP Act and GDPR deadlines, and a daily check that every closed incident records its lessons learned.
The evidence library
160 requests covering every clause and control, each with an owner and a refresh date, and 17 checks run daily.
The screens you work in.
Shown for an example company.
The register on likelihood and impact, owners and treatment, and the 5×5 heat map.
| Risk | Owner | Score | Treatment |
|---|---|---|---|
R-03 Card data exposed through a misconfigured processor integration | IT Security | 20 Critical | Treatment plan due 30 Nov |
R-07 Regulatory filing missed after a change in reporting format | Risk Operations | 15 High | Mitigating |
R-11 Phishing of the finance team | HR | 16 High | Mitigating |
R-02 Key supplier unavailable during settlement window | Operations | 10 Medium | Accepted |
R-14 Stale access for leavers | IT Security | 9 Low | Mitigating |
Regulane does not
- Link a risk to the controls that treat it. They sit side by side.
- Collect evidence from AWS, Azure or GCP. Evidence is handed in by a person, or checked daily from your records and GitHub.
- Close a corrective action without a second person verifying it.
Questions
Risk and audit, answered.
Does Regulane link risks to controls?
Not yet. The risk register and the ISO 27001 controls sit side by side, and a daily check flags any open high risk without a treatment plan. A link from a risk to the controls that treat it is not stored today.
Who can close a corrective action?
A manager who neither did the work nor is assigned it. They record an effectiveness rating when they verify it. The server enforces this, not the browser.
Can an external auditor see the audit?
Yes. An auditor gets read-only access to the workspace without using a paid seat.
Keep reading
- ISO 27001Annex A, clauses 4–10, the Statement of Applicability and audit preparation.
- DPDP ActThe Data Fiduciary obligations, the processing register, requests and breaches.
- Free DPDP Act checkCheck your website against the DPDP Rules now, free, with no sign-up.
- SecurityWhere your data lives, what the code enforces, and what we do not claim.
Regulators publish every week. Know which changes are yours the day they appear.
14-day trial · No card required · Per workspace, never per seat