From intelligence
to action.
Build the operating layer for compliance, risk and fraud. Orchestrate what matters. Protect what counts.
Talk to AurachainBefore
Ratings platforms
Score your vendors continuously.
Solutions · Risk
Risk you can see is not risk you’ve handled.
Ratings tell you a vendor’s score. Registers tell you the risk exists. Aurachain runs what happens next the assessment, the escalation, the remediation, the evidence as one governed process across every third party and every internal control.
The gap in the risk stack
Everyone can tell you the risk.
Almost nobody runs what comes after.
In most institutions that work still runs on email and spreadsheets. It is also the part a supervisor examines.
The work in between
Between the score and the register sits the actual work.
01Chasing the assessment
02Judging the finding
03Agreeing the remediation
04Proving it closed
After
GRC suites
Hold the register, the policy and the control library.
The execution layer where risk signals become governed, audited action.
What runs on it
Two kinds of risk, one system underneath. The signals arrive from wherever you already get them. What happens next runs here.
External risk
Third-Party Risk Management
Your vendors’ risk is your risk. Every major supervisory regime now says so explicitly, and asks to see how you manage it, not just that you have a policy.
01
Onboarding & Due Diligence
Before the contract is signed: criticality classification, due diligence proportionate to it, and the approval on record. A workflow with an owner and a deadline, not a questionnaire somebody has to chase.
02
Assessment Campaigns
Issue, chase, validate and consolidate vendor assessments without a tracking spreadsheet. Reminders, escalations and completion status are part of the process rather than someone’s Thursday afternoon.
03
Remediation & Exit
A finding that isn’t closed is a finding that’s still open. Aurachain tracks remediation to closure with an owner, a deadline and an evidence requirement and governs exit when the relationship ends.
04
Register & Reporting
Supervisors increasingly want a maintained, reportable register of third-party arrangements. Aurachain keeps it populated by the processes that create those relationships, not by a quarterly data-gathering exercise.
Internal risk
Operational Risk Management
Ask a supervisor what tells them most about a firm’s operational risk and many will say: show me the RCSA. In most institutions it is a colour-coded spreadsheet, refreshed once a year, then set aside.
01
Risk & Control Self-Assessment
Run the RCSA as a live process rather than an annual artifact: scoped, scored, challenged and signed off in one system, with the inherent-to-residual reasoning captured where it was made.
02
Control Testing & Attestation
Testing schedules, evidence capture and attestation run as governed workflows. When a control fails its test, the issue opens itself and lands with an owner.
03
Incident & Loss Events
An operational loss event enters as a case classified, investigated, linked to the control that should have caught it, and closed with the lesson recorded against the risk it belongs to.
04
Issue & Action Tracking
Every finding, wherever it came from audit, RCSA, incident, supervisor, self-identified gets an owner, a deadline and an evidence requirement, tracked in one place until it actually closes.
Continuous oversight
Risk Monitoring & Alerts
An application in its own right: continuous monitoring, with every alert owned, actioned and recorded.
Thresholds, key risk indicators, review dates and contract dates sit in one place, evaluated against the signals your own systems and providers already produce. When something crosses a line, Aurachain raises the alert to a named owner with a deadline attached, escalates it if nothing happens, and keeps the record of what fired, who saw it and what they did about it.
Whether the thing being watched is a vendor or an internal control, the mechanics are the same.
Covers
Threshold and KRI configurationSignal intake from connected sourcesOwned alerts with deadlinesEscalation rulesAlert history and audit trail
What it watches
Rating changeKRI breachOverdue attestationFailed control testContract renewalVendor incidentConcentration thresholdNew audit findingSanctions or ownership change
Beyond the two
Risk Insights
Ask nine risk domains for their assessment and you get nine spreadsheets, forty emails and a consolidation job nobody wants.
How the cycle runs today
- Manual data transfers between a master sheet and every contributor’s copy
- Spreadsheet setup and maintenance rebuilt every cycle
- Fragmented references with no single source of truth
- Manual email coordination inviting, chasing, tracking who has replied
- No validation before submission , so errors surface during consolidation
- Back-and-forth clarification cycles that stretch the calendar
On Aurachain
- Structured risk workflows contributors work in an interface, not a file
- Guided collaboration with built-in variations and in-context guidance
- Analytics-ready data , structured for modelling from the moment it’s entered
- Automated lifecycle invitations, reminders and tracking send themselves
- Validation at the point of entry , with immediate notifications and insight reports
- Client-specific workflows tailored per client, from one underlying process
Aurachain does not model your risk. It produces the data your model needs, in the shape it needs, without anyone retyping it.
How a risk signal actually runs
Same four movements, whether it started with a vendor or inside your own controls.
01
The signal arrives
A rating drop, a KRI breach, a failed control test, a renewal date, a self-identified issue. It enters as a case with an owner, not a line on a dashboard.
02
The process picks it up
Severity, routing and escalation are configured against your risk appetite, not hard-coded. Change the threshold and the process changes with it.
03
A person judges it
AI assembles the context history, related findings, prior decisions, the control that applies. The risk judgment stays with your team, and the reasoning is captured where it was made.
04
The record closes itself
Assessment, decision, remediation and evidence sit in the case that produced them. The register becomes a by-product of the work rather than a separate exercise.
Three regimes, one obligation
What the supervisors are asking for
The wording differs by jurisdiction. The demand does not: assess the risk before you take it on, oversee it while you hold it, and be able to show both.
United States
Interagency Guidance on Third-Party RelationshipsIssued jointly by the Federal Reserve, FDIC and OCC in June 2023, replacing each agency’s earlier guidance. Built around the third-party lifecycle planning, due diligence, contracting, ongoing monitoring, termination with oversight proportionate to criticality.
European Union
DORA — Regulation (EU) 2022/2554Applicable since January 2025. Its ICT third-party pillar requires a maintained, reportable register of every ICT arrangement rather than a policy describing one, alongside due diligence and contractual controls.
South Africa
FSCA & Prudential Authority Joint StandardsJoint Standard 1 of 2023 on IT governance and risk management, and Joint Standard 1 of 2024 on outsourcing. Issued under the Financial Sector Regulation Act, they carry the force of subordinate legislation rather than guidance.
Global
Basel operational risk frameworkOperational risk carries capital weight in every Basel-aligned regime, and the risk and control self-assessment is how a supervisor judges whether an institution genuinely understands its own operational risk profile.
Three regimes, three vocabularies, one process underneath. Aurachain does not rate your vendors or model your risk. It runs the process you have defined around both, and keeps the proof in whichever form the supervisor asking happens to want it.
Trusted by regulated institutions across US, Europe, Africa and the Middle East
Risk work running in production
Different exposures, different teams, one platform underneath.
Third-party risk
Onboarding, assessment campaigns and continuous oversight held in one register.
Controls & assessmentsRCSA, control testing and attestation running as live processes rather than annual cycles.
Approval routing across partiesMulti-party approval with the audit trail written as the process runs.
FAQ
Questions we get asked
Does Aurachain replace our security ratings provider?
No. Ratings, telemetry and external intelligence stay with the providers you have chosen. Aurachain is where their signals become governed work assessed, decided, remediated and evidenced in one case.
Is this a GRC platform?
No. A GRC platform stores what is required: the register, the policy, the control library. Aurachain runs the work that fills them. Institutions running both usually find the GRC suite holds the shape of the programme while the execution happens somewhere it cannot be audited.
We operate under more than one regime. Does that mean more than one process?
No. The underlying process is the same everywhere assess, oversee, evidence. What changes per jurisdiction is the evidence requirement, the register format and the reporting trigger, and those are configured rather than rebuilt. One process, several outputs.
Can third-party risk and operational risk run in the same system?
Yes, and there is a reason to. A vendor failure is an operational risk event. When both run on one platform, the link between them is a fact in the record rather than something a person has to notice.
What happens to the spreadsheets we run today?
The structure moves; the format does not. An existing RCSA or assessment template becomes a structured workflow with the same fields, the same scoring and the same owners — with validation before submission rather than reconciliation afterwards.
Where does AI sit in a risk process?
Inside the step, not in place of it. An agent assembles context, drafts an assessment summary or ranks a queue. A person makes the risk judgment and records why. No AI closes a risk case on its own.