What is OrviQ?

OrviQ is an enterprise Governance, Risk, and Compliance (GRC) platform built to manage complex regulatory requirements and connect them directly to operational internal controls and verified evidence.

In modern regulated industries, compliance teams struggle with fragmented spreadsheets, ambiguous regulatory texts, disconnected control registers, and manual audit cycles. OrviQ solves this by creating a unified, auditable graph connecting regulations, internal controls, risks, policies, and evidence.

---

Core Principles & Compliance Doctrine

OrviQ operates under a strict compliance doctrine designed to prevent false assurances:

1. Mapping is Not Compliance
   Connecting a regulatory requirement to an internal control establishes intent and coverage, but does not prove compliance. Compliance requires verified design adequacy, active operational effectiveness, and sufficient evidence.

2. Evidence Existence is Not Evidence Sufficiency
   Uploading a document does not automatically satisfy an obligation. Evidence must be reviewed for relevance, completeness, period coverage, and freshness.

3. Absence of Assessment is Never a Verdict
   When a control or requirement has not yet been evaluated, OrviQ designates its state as Not Assessed or Unassessed. It never defaults unverified records to "Compliant" or "Effective".

4. Governed Human Decision-Making
   AI models assist by decomposing requirements, recommending mappings, and extracting evidence facts. However, all critical compliance determinations, policy publications, and exception approvals require explicit human sign-off through governed approval workflows.

---

Key Capabilities

• Regulatory Intelligence & Scoping: Ingest standards (e.g., UAE IA, ISO 27001, NIST CSF), define applicability scope, and track granular sub-obligations.
• Control Crosswalk: Build many-to-many semantic relationships between regulatory clauses and internal controls with documented rationales.
• Evidence Fabric: Manage evidence artifacts, track validity periods, and monitor freshness with automated review prompts.
• Connected Enterprise Risk: Connect identified risks to mitigating controls, evaluate residual risk posture, and manage remediation action plans.
• Policy Governance: Maintain versioned corporate policies, track periodic review cycles, and map policies to underlying regulatory mandates.
• Grounded AI Assistant: An intelligent assistant that operates with strict tenant data isolation, page-awareness, and verifiable deep-link citations.

---

Next Steps

• Explore the Platform Overview to understand the 12 core functional domains.
• Review Key Concepts to understand requirements, controls, and mappings.
• Learn about User Roles and permission entitlements.