Docs

Appearance

Enterprise Quick-Start Guide ​

This guide outlines a structured, 10-step sequence for onboarding an enterprise organization onto OrviQ. It walks through configuring foundational access, establishing institutional scope, adopting governing policies, connecting internal controls to evidence, and enabling ongoing assurance.

Crucial Governance Principle

Completing this onboarding sequence provides the organizational infrastructure and audit trails necessary for compliance management. Following this sequence does not automatically confer regulatory compliance. Compliance determination requires verified operational control performance, adequate evidence, and formal managerial sign-off.

Step 1: Access and Roles ​

Begin by provisioning organizational accounts and establishing role-based access control (RBAC) boundaries:

  1. Verify Tenant Administrator Access: Log in as the initial tenant_admin. Ensure multi-factor authentication (MFA) and enterprise single sign-on (SSO) integration are configured if enabled.
  2. Provision Core Users: Navigate to Administration > Users & Roles (/admin/users). Create accounts for compliance managers, risk leads, control owners, and auditors.
  3. Assign Canonical Roles: Assign users to standard roles based on the principle of least privilege:
    • compliance_manager / compliance_officer
    • risk_manager
    • control_owner
    • auditor
  4. Verify Entitlements: Confirm that tenant feature entitlements (compliance_core, policy_governance, risk_management, control_assurance) match your licensed agreement.

Learn more in User Roles & RBAC and Users & Roles Administration.

Step 2: Establish Organizational Scope ​

Compliance and risk determinations are meaningless without clear operational boundaries:

  1. Define Organizational Units & Environments: Navigate to Regulatory Compliance > Scope Registry (/scope-registry). Register business units, legal entities, data centers, and critical environments.
  2. Populate Key Assets & Systems: Navigate to Regulatory Compliance > Assets & Inventory (/inventory). Register critical business applications, infrastructure tiers, and databases that fall under regulatory scrutiny.
  3. Review Scoping Criteria: Determine which organizational assets and legal entities are in scope for specific regulatory mandates and policy obligations.

Learn more in Scope & Applicability and Scope Registry.

Step 3: Review Governance & Regulatory Context ​

Establish the regulatory mandates and standards governing your enterprise:

  1. Browse Framework Library: Navigate to Regulatory Compliance > Frameworks (/frameworks) or the Regulatory Library (/library). Review available statutory frameworks (e.g., CBUAE, SBP, UAE IA, ISO 27001, NIST CSF).
  2. Ingest Regulatory Circulars: Ingest mandated regulations or circulars via Smart Extract (/smart-extract) or structured frameworks.
  3. Inspect Requirements Register: Review parsed obligations in Regulatory Compliance > Requirements (/requirements). Inspect atomic obligation statements, categories, and mandates.

Learn more in The Requirement Pipeline and Smart Extract.

Step 4: Configure or Review Risks ​

Set up the connected risk register and appetite boundaries:

  1. Establish Risk Methodology: Navigate to Administration > Risk Methodology (/settings/risk-methodology). Verify likelihood/impact scales (e.g., $5 \times 5$ matrix) and scoring bands.
  2. Review Enterprise Risk Register: Navigate to Risk Management > Risk Register (/risks). Populate top organizational risks (RSK-YYYY-NNNN), noting inherent risk ratings and risk categories.
  3. Set Key Risk Indicators (KRIs): Navigate to Risk Management > KRI Register (/kris). Define leading indicators, collection frequencies, and threshold alert boundaries.

Learn more in Enterprise Risk Register and KRI Register.

Step 5: Establish Policies ​

Formulate corporate policies and decompose them into enforceable obligations:

  1. Adopt Certified Policy Packs: Navigate to Policy Governance > Policy Packs (/governance/packs). Browse certified Content 2.0 packs (e.g., Commercial Banking, Core Governance) and adopt relevant templates into your tenant.
  2. Author Internal Policies: In Policy Governance > Policy Library (/governance/library), author custom internal policies. Structure each policy into clear sections and atomic statements (POL-YYYY-NNNN).
  3. Set Review Cadences: Assign accountable policy owners and establish annual review dates monitored via the Expiry Monitor (/governance/expiry).

Learn more in Policy Register and Content Library.

Step 6: Map Controls ​

Bridge governing expectations to internal operational controls:

  1. Populate Control Register: Navigate to Controls & Assurance > Control Register (/controls). Register internal controls (CTRL-XXX), specifying control functions (preventive, detective, directive), implementation types, and assigned control owners.
  2. Create Crosswalk Mappings: Open Controls & Assurance > Control Crosswalk (/crosswalk). Connect internal controls to regulatory requirements (REQ-) using formal relationship types (satisfies, partially_satisfies).
  3. Operationalize Policy Statements: In Policy Governance > Operationalization (/governance/operationalization), link atomic policy statements to the operating controls, risks, and owners responsible for executing them.

Semantic Guardrail: Mapping $\neq$ Compliance

Establishing a crosswalk relationship or operational link records structural coverage; it does not prove the control is implemented or effective.

Learn more in Control Crosswalk and Policy Operationalization.

Step 7: Connect Evidence ​

Back up operational claims with verified, timestamped evidence:

  1. Define Expected Evidence: For each critical control or requirement, specify expected evidence artifacts, expected collection cadences, and mandatory flags.
  2. Configure Evidence Fabric Connections: Navigate to Controls & Assurance > Evidence Fabric (/evidence/fabric). Set up automated connectors or integration pipelines.
  3. Upload and Link Artifacts: In Controls & Assurance > Evidence Register (/evidence), upload files or link data streams. Each artifact receives a SHA-256 cryptographic hash and immutable upload timestamp.
  4. Approve Evidence Links: Review draft evidence links through governed maker-checker review.

Semantic Guardrail: Evidence $\neq$ Effectiveness

The existence of an uploaded log or report confirms collection; it does not prove the control operated effectively throughout the audit period.

Learn more in Evidence Register and Evidence Fabric.

Step 8: Review Assurance & Findings ​

Continuously evaluate control adequacy and identify deficiencies:

  1. Execute Control Assessments: In Controls & Assurance > Control Assessment (/assess), evaluate Design Adequacy and Operating Effectiveness based on linked evidence.
  2. Monitor Continuous Assurance: In Controls & Assurance > Continuous Assurance (/assurance), track real-time health indicators and freshness metrics across automated collectors.
  3. Inspect Policy Gap Workbench: In Policy Governance > Gap Workbench (/governance/gaps), review unmapped statements, missing controls, and failed assessments.
  4. Review Findings Register: In Risk Management > Findings (/findings), triage deficiencies discovered by automated checks, assessments, or audit inspections.

Learn more in Continuous Assurance, Gap Workbench, and Findings Register.

Step 9: Govern Remediation & Exceptions ​

Manage issues transparently under strict segregation of duties:

  1. Formulate Action Plans: For confirmed findings, open Risk Management > Action Plans (/action-plans). Assign accountable owners, target milestones, and due dates.
  2. Request Time-Bound Exceptions: If full compliance cannot be immediately achieved, submit a formal exception in Policy Governance > Policy Exceptions (/governance/exceptions) or Risk Management > Exceptions (/exceptions).
  3. Execute Governed Sign-Off: Route exceptions through multi-eye review in Approvals Hub (/approvals). Every approval requires written justification and a hard expiry timestamp.

Semantic Guardrail: Exception Approved $\neq$ Control Effective

An approved exception acknowledges managerial risk acceptance of a known deficiency; it does not eliminate the deficiency or make the control effective.

Learn more in Action Plans, Policy Exceptions, and Approvals Hub.

Step 10: Use Dashboards & Reporting ​

Maintain executive oversight and deliver audit-ready reports:

  1. Executive Dashboard: Monitor real-time operational posture, active work items, and open deficiencies on the Home Dashboard (/dashboard).
  2. Compliance Posture & Visualizer: Review framework-wide coverage, multi-dimensional scorecards, and relationship graphs in Reports > Compliance Dashboard (/compliance-dashboard) and Compliance Visualizer (/visualizer).
  3. Export Governance Packages: Generate board-level summaries, regulator-ready inspection packs, and Statement of Applicability (SoA) documents in Reports (/reports).
  4. Interact with OrviQ Assistant: Press Ctrl+J from any page to open OrviQ Assistant for contextual summaries, blocker explanations, and audit lineage traces.

Learn more in Dashboards and Reports & Exports.

OrviQ Enterprise Governance, Risk & Compliance Platform

Copyright © 2026 OrviQ. All rights reserved.