Appearance
OrviQ Documentation
OrviQ is an enterprise Governance, Risk and Compliance platform. It takes a regulatory obligation from the moment an authority publishes it to a governed, defensible statement about whether your organisation meets it.
Where to start
| If you are | Start here |
|---|---|
| New to OrviQ | What is OrviQ?, then The Requirement Pipeline |
| Evaluating the platform | The Requirement Pipeline and Separation Principles |
| Implementing it | First-Time Setup and Scope Registry |
| Administering it | Administration |
| Operating it day to day | Workbench and your domain's register documentation |
| Auditing or reviewing | Compliance Determination and Historical Reconstruction |
The two pages that explain the platform
The Requirement Pipeline describes the twelve stages an obligation passes through and why each is a separate, auditable fact.
Separation Principles describes the eight non-equivalences OrviQ enforces structurally. Together they explain most of the platform's behaviour, including the parts that look pedantic until you need to defend a number.
Documentation by domain
Getting started
Foundational orientation: what OrviQ is, how to navigate it, roles and permissions, and first-time configuration.
What is OrviQ? · Platform Overview · Key Concepts · Getting Around · User Roles · First-Time Setup
Concepts
The doctrine beneath the product: requirements, applicability, controls, evidence, assurance, risk, findings, policies, governed workflow and business references.
Separation Principles · Requirements & Obligations · Applicability & Scoping · Internal Controls · Evidence Fabric · Continuous Assurance · Risk Management · Findings · Action Plans · Policy Governance · Governed Workflows · Business References
Regulatory & Compliance
From regulatory source to governed determination: sources, changes, frameworks, extraction, requirements, adoption, applicability, the Statement of Applicability and requirement assurance.
Controls & Assurance
Control register, crosswalk and its eight relationship semantics, control assessment, evidence fabric, collectors, indicators and control effectiveness.
Risk & Remediation
Enterprise risk register, methodology, RCSA, KRIs, governed risk acceptance, findings, action plans and exceptions.
Audit & Oversight
Internal audit planning, engagements, fieldwork, findings and sign-off; and regulatory inspections, items and response packages.
Third-Party Risk
Parties, engagements, criticality, regulatory classification, due diligence, risk assessment and governed decisions.
Policy Governance
Policy register, lifecycle, governed publication and attestation campaigns.
Operational Resilience
Assets, declared scopes, business impact analysis, continuity plans, exercises and six-dimension resilience assessment.
Incidents & Loss Events
Incident register, classification, investigation, the financial loss ledger and governed closure.
Enterprise Workflow
Workbench, Approvals Hub, notifications, GRC Calendar, workflow templates, multi-eye approvals, segregation of duties and decision history.
AI in OrviQ
Every AI capability, the authority boundary it never crosses, provenance, human-in-the-loop governance and honest limitations.
Reporting
Dashboards, compliance posture, reports and exports, and historical reconstruction.
Administration
Users and roles, entitlements, workflow configuration, tenant settings, SLA policy, notifications, AI provider settings, integrations and security boundaries.
Cross-Module Journeys
Six end-to-end worked examples: regulation to compliance, framework adoption to SoA, control failure to remediation, incident to risk, audit and third-party onboarding.
Practical guides
How-To Guides
Step-by-step procedures for common tasks.
Product Areas
One landing page per navigation domain, listing its pages and the documentation for each.
OrviQ Assistant
The grounded AI assistant: page context, citations, chat history, tenant boundaries and what it will not do.
Reference
Status Definitions · Terminology & Glossary · Roles & Permissions · Business References · Relationship Types · Workflow Behaviors · Supported Data Formats · FAQ · External Standards
Troubleshooting
Common issues, workflow states, unassessed and pending states, and AI provider diagnostics.
Security & Privacy
Tenant isolation, identity and access, AI provider security, assistant data boundaries and secret handling.
What makes OrviQ different
OrviQ will show you not_assessed where another platform shows a comfortable number, and it will refuse to let a bulk import turn a standard green.
The return is that every figure it does show traces to a named record, a named person and a timestamp, and survives the follow-up question.
If that sounds like a constraint rather than a feature, Separation Principles explains why it is the latter.