SystemCommercial

Compliance Risk Narratives

Quarterly compliance risk reporting, with every figure in the narrative traced to its query

The quarterly risk narrative, drafted in minutes with every figure from a live query.

See one case, screen by screen ↓
demo38minfrom data close to a drafted Q3 narrative, against 9 days by hand a year earlier
demo100%of figures traced to a live query — 32 of 32 in the Q3 draft
demo121 → 83reports in four channels resolved to distinct issues, each counted once
demo8sources joined on market, party and quarter into one view of risk
The problem

Why the quarterly risk narrative takes days, and still gets questioned

The quarter closes and the Compliance Committee wants to know one thing: why residual risk moved. The answer sits in eight places — risk assessment scores, control testing results, the speak-up hotline, internal audit findings, monitoring alerts, the investigations log, mitigation plans and the third-party register — and they share no keys.

So the work is reconciliation. A hotline report and an audit finding about the same distributor have to be found and counted once. Every number has to be pulled, checked and written up in plain words. And when a monitoring feed does not arrive, the honest answer is “not available” — an approximate figure is worse than none.

demo9daysto write the Q3 2025 narrative by hand
demo31%of issue reports duplicate an issue already raised in another channel
demo2empty query results in the Q3 draft — reported as “none” and “not available”, not estimated
Where a quarter’s narrative hours goestimated
By hand72 days
With the solution5.5 days
  • Pulling and reconciling eight sources22 → 0.2 d
  • Matching the same issue across channels12 → 0.5 d
  • Working out what moved and why14 → 2 d
  • Writing the narrative16 → 1 d
  • Checking every figure6 → 0.3 d
  • Officer review and sign-off2 → 1.5 d

Estimated split, in working hours, for one quarterly narrative by hand and with the solution. With the solution, the hours left are mostly people reading, checking and signing what the agents drafted.

How it works

How a narrative moves

Six agents query eight sources, merge duplicate issues and write; the chief compliance officer approves.

What comes in
Sources in8 sources · scores, issues, plans
Agents at work
Query agentread-only, every number
Then
De-duplication agent
Risk movement analyst
Mitigation and focus analyst
Then
Issue driver analystissues per area
Then
Narrative writerevery figure traced
A person decides
Chief compliance officerapproves and signs
What comes out
Quarterly narrative
Market deep dives
Figures traced
One case, step by step

One quarter, from data close to a signed narrative

Q3 2026 closed on Sep 30. Brazil’s residual risk has risen to High, and the Compliance Committee meets on Oct 15. Here is what happens next, screen by screen, in the working solution.

  1. 01Morning

    The quarter, on one screen

    Lena Ortiz · Chief compliance officer

    Lena opens the solution: residual risk rose in 5 of 12 markets, Brazil most at +2.0. 121 reports in four channels resolve to 83 distinct issues, and the committee report is due in 9 days. Under “Needs you”: the Q3 draft waiting for her approval, Brazil now High, one issue raised in four channels, an overdue margin-cap plan.

    “Colombia — September monitoring feed not received. The report says “not available” for this figure; nothing was estimated.”

  2. 02One click

    “Run quarterly narrative” — and the agents start

    Lena Ortiz · Chief compliance officer

    The eight sources load. The Query agent runs 214 read-only queries; the De-duplication agent turns 121 reports into 83 issues, merging 38 duplicates across four channels. Five guided analyses run in parallel, the Narrative writer drafts five sections, and the figure check traces 32 of 32 numbers. The last step waits for Lena.

    “Draft ready. 32 figures, each from a live query · 2 empty results reported, not filled · waiting for your approval.”

  3. 03Next

    The risk map: twelve markets, six risk areas

    Lena Ortiz · Chief compliance officer

    Residual risk by market and area on a 1–25 scale — HCP engagement, distributors, tenders, grants, hospitality and demo kit — each cell a live query over the risk assessment scores. Brazil sits at 13.0 · High, with distributors at 19 and tenders at 15. Colombia carries a “gap” flag for its missing feed.

  4. 043.5 seconds

    What moved Brazil — two areas explain the whole rise

    Risk movement analyst

    Brazil went from 11.0 to 13.0, the largest rise of the 12 markets. Distributors & agents went 12 → 19: the due-diligence control was rated Weak after 7 of 19 distributor reviews were overdue at quarter end, against 1 of 19 in Q2. Public tenders went 10 → 15: only 5 of 8 sampled tender reviews passed testing. The other 4 of 6 areas did not move.

    “Investigations closed in Brazil this quarter: None — the query returned no rows, so the report says none.”

  5. 05Hover any figure

    Every number, with the query behind it

    Query agent

    Each figure the analyst wrote sits in the Figures panel with its value, the query text, the row count, the source and the time it ran. Hover “12 → 19” and the query over the risk assessment scores appears: 2 rows, ran Oct 6, 09:14. The control rating comes from the control testing results, the overdue reviews from the third-party register.

  6. 06Next

    Which issues drove it — each one counted once

    De-duplication agent

    23 Brazil reports — 5 hotline, 5 audit, 10 monitoring, 3 investigation — resolve to 14 distinct issues, 8 of them in the two areas that moved. The largest, ISS-BR-031, is one allegation raised in all four channels: matched on Andara Distribuidora by tax ID, Hospital Santa Clara and payments through credit notes, at similarity 0.94, and confirmed by Rafael Souza, compliance lead for Brazil, on Oct 2.

    Merges below 0.85 similarity go to the market compliance lead. A merge is reversible and logged.

  7. 07Ranked

    Where to focus, ranked by risk lowered

    Mitigation and focus analyst

    Three actions for Brazil. Finish the 7 distributor due-diligence renewals — plan MP-BR-11, 3 of 7 done — which would take the area from 19 to 12 under the scoring rules (inherent 20 × 0.60). Close the margin-cap plan MP-BR-09, 6 days overdue, with credit notes coded “marketing support” at R$ 184,000. Send tender comments for legal review. Lena adds what she wants to the report.

    “Projections use the published scoring rules only and are labelled as projections in the report.”

  8. 08Drafted

    The narrative, in the committee’s language

    Narrative writer

    Five sections — what moved the risk, which issues drove it, mitigation status, where to focus, data notes — opening with a short summary: average residual risk moved from 8.8 to 8.9, Brazil is the only market rated High, 6 of 42 open plans are overdue. Allegations are worded as allegations. The Colombia figure is reported as not available, with nothing carried over from August.

    “32 of 32 figures traced to a live query · 2 empty results reported as such.”

  9. 09Signed

    The officer approves, and signs

    Lena Ortiz · Chief compliance officer

    Lena reads the draft, hovers the figures she wants to check, and chooses Approve report. She signs with her password and the meaning of her signature — “I approve this report for the Compliance Committee”. Her name, the date and time and the meaning are recorded with the report, and the version is locked before it goes to the committee.

  10. 10Every quarter

    How the narrative is produced, quarter on quarter

    Maya Chen · Compliance analytics lead

    The dashboard shows residual risk by quarter for Brazil, Mexico and all markets, and the time to write the narrative: 9 days and 8 days by hand, then 2.5 hours, 52 minutes and 38 minutes with the agents. Reports received against new distinct issues, per channel, and distinct issues by risk area sit alongside.

Who it’s for

Built for everyone who answers to the committee.

The same quarter, seen by the five people who carry it — what it looked like before, and what it looks like now.

LO
Lena OrtizChief compliance officer
Approver
Before
Signs a narrative stitched together from eight sources, and has to trust each number in it.
Now
Hovers any figure to see the query behind it, and signs a version that is locked once approved.
MC
Maya ChenCompliance analytics lead
Sources, rules and scoring
Before
Rebuilds the joins between scores, issues and plans every quarter.
Now
Manages the eight sources, the matching rules and the residual risk formula in one place.
RS
Rafael SouzaCompliance lead, Brazil
Market compliance lead
Before
Sees a hotline report and an audit finding about the same distributor as two separate issues.
Now
Confirms merges for his market, owns its plans and reviews his own section of the report.
OH
Omar HaddadHead of investigations
Investigations
Before
Gets the same allegation from four channels as four separate items.
Now
Sees one issue with every linked report and its source — and is the role that may see hotline reporter details.
DO
Dana OkaforInternal audit lead
Read only
Before
Asks where a number in the committee report came from.
Now
Reads everything — issues, figures, queries — and changes nothing.
Built on the engine

6 agents. Each with one job, and hard limits.

Six agents query eight sources, merge duplicate issues and write; the chief compliance officer approves.

Query agent

Answers every number with a read-only query over the eight sources and returns the value, the query, the row count and the time it ran.

  • Read-only access — cannot change any score, issue or plan
  • An empty result is returned as empty, never estimated
  • Every value carries the query that produced it
De-duplication agent

Finds hotline, audit, monitoring and investigation reports about the same matter and links them to one issue — matching on party (tax ID or name), place, kind of allegation and a 45-day window.

  • Merges below 0.85 similarity go to a person
  • Hotline reporter identity never leaves the hotline record
  • A merge is reversible and logged
Risk movement analyst

Explains why a market’s residual risk moved: which areas, which control ratings, and the facts behind them.

  • No number without a query
  • Names the control test behind every rating change
Issue driver analyst

Links distinct issues to the risk areas that moved and ranks them by severity, recurrence and channel count.

  • Counts distinct issues, never raw reports
  • Allegations are described, never presented as findings
Mitigation and focus analyst

Reads plan status and due dates, flags overdue actions and ranks where attention will lower residual risk most.

  • Projections use the scoring rules only and are labelled as such
Narrative writer

Writes the quarterly narrative for the Compliance Committee in plain language; every figure is filled from a Query agent result and can be traced.

  • The figure check blocks the draft if any number has no query
  • Allegations are worded as allegations
  • Writes “none” or “not available” when a result is empty
Chief compliance officer

Approves and signs. The agents propose; a named person decides.

Ask in plain words

Ask it anything, in plain words

Ask about any market, issue or figure — or tell it what to change. Answers carry their sources, and changes go to the owner to accept.

Why did Brazil’s residual risk go up?

Brazil rose from 11.0 to 13.0 (+2.0) — the largest rise of 12 markets. Two areas explain all of it: distributors went 12 → 19 with 7 of 19 due-diligence reviews overdue, and tenders went 10 → 15 with 5 of 8 tender reviews passed. Every number is a live query.

Show me the high-severity issues from the hotline

There are 4 open high-severity issues raised through the hotline — two in Brazil (the Andara Distribuidora payments and the Sorocaba tender specification), one in Mexico and one in China. I filtered the issue list for you.

Add a focus action for distributor due diligence in Mexico

Done. I added MP-MX-07 · Renew due diligence for Mexico distributors that ship to public hospitals, owner Lucía Romero, due Dec 15, as a proposed plan. It goes to Lucía to accept. Mexico distributors scored 15 this quarter (Q2: 13).

What happens when data is missing?

When a query returns nothing, the report says so. Two examples in Q3: investigations closed in Brazil — none (0 rows); Colombia’s September monitoring feed — not available. Nothing is averaged, carried over or estimated; that rule is locked in Settings.

Every screen

The working solution, as it ships.

13 screens from the working solution, on its sample data. Pick one to see it large.

HomeThe quarter for the chief compliance officer: markets where risk rose, distinct issues, figures traced and days to the committee.
Run quarterly narrativeEight sources loaded, 214 read-only queries, 121 reports to 83 issues, five analyses, five sections and a figure check.
The risk mapResidual risk for 12 markets and six risk areas, each cell a live query, sorted by change.
What moved the riskBrazil’s rise attributed to two areas and the control ratings behind them, with every figure in the panel beside it.
The query behind a figureHover a number to see its query, row count, source and the time it ran.
One issue, four channelsHotline, monitoring, audit and investigation reports about the same payments, matched and counted once.
Where to focusActions ranked by risk lowered, with projections from the scoring rules labelled as projections.
Every issueDistinct issues by market, risk area, channel, severity and status — filterable, and exportable.
An issue and its reportsEvery linked report with its source, the match reason and similarity, and who confirmed it.
The quarterly narrativeFive sections for the Compliance Committee, every figure traced, with the approval path beside it.
Approve and signThe officer signs with a password and the meaning of the signature; approval locks the version.
The dashboardResidual risk by quarter, time to the draft, reports against distinct issues and issues by risk area.
Your rulesMatching window, merges a person confirms, residual risk scoring, the High threshold and who signs.
Governance

Built for compliance work: traced, protected, signed.

Every figure from a live queryEach number in the narrative is stored with its query, row count, source and run time. Hover it to see where it came from; the figure check blocks a draft if a single number has no query.
A missing figure is never estimatedAn empty query is reported as “none” or “not available”. Nothing is averaged, carried over from last month or filled from other markets — a rule locked by the compliance policy.
Sources are read, never changedThe eight sources refresh nightly and read-only. The agents cannot change a score, an issue or a mitigation plan; a new plan they propose goes to its owner to accept.
Each issue counted once, with a person on the edge casesMatches below 0.85 similarity go to the market compliance lead. Every merge is reversible and logged, and a request to split a report out goes to the market compliance lead to confirm.
Hotline reporters stay protectedReporter identity stays in the hotline record — the agents see the allegation only. The investigations role sees hotline reporter details; internal audit reads everything and changes nothing.
The officer signs, and the version locksThe chief compliance officer approves with a password and the meaning of the signature; name, date, time and meaning are recorded with the report, and approval locks that version.
Configuration

Your compliance programme’s rules, not ours

How issues are matched, how risk is scored and who signs are settings, set once by your compliance analytics lead.

SettingDefaultChoose from
Match reports within45 days30 · 45 · 60 days
Merges a person must confirmBelow 0.85Below 0.85 · Below 0.90 · All merges
Residual riskInherent risk × control factorStrong 0.40 · Adequate 0.60 · Needs improvement 0.75 · Weak 0.95
A market is rated High from13.012.0 · 13.0 · 14.0
Signs the quarterly reportLena OrtizLena Ortiz · Omar Haddad
Reviews each market deep diveMarket compliance leadMarket compliance lead · Lena Ortiz
Send the approved report toCompliance CommitteeCompliance Committee · Compliance Committee and Audit Committee
Never estimate a missing figureOnLocked by the compliance policy
Connections

Works with the sources your programme already keeps

Risk assessment and control testingscores by market and area, control test results
Speak-up hotlinereports in, reporter details stay in the hotline
Internal audit findingsfindings by audit and market
Compliance monitoringspend monitoring alerts, with missing feeds flagged
Investigations and mitigation plansthe case log, plan owners, due dates and progress
Third-party due-diligence registerdistributors and agents, review dates
What it changes

The difference, in numbers.

Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.

target
36min
from data close to a drafted quarterly narrative
By hand≈ 9 days
With agents≈ 36 min
proven
100%
of figures from a live query, each one traceable
figures traced to their query
proven
8
data sources joined into one view of risk
Joined on shared keys
market, party, quarter

“demo” = seen in the working solution, on its sample data for 12 markets in Q3 2026 · “estimated” = our estimate of where the hours go. People, companies and products named on this page are fictional — characters and sample data in the working solution.

Questions

What compliance teams ask us.

What is compliance risk reporting software?

Software that brings a compliance programme’s risk scores, control tests and issue channels together and turns them into the periodic report for the Compliance Committee. Compliance Risk Narratives adds six agents that query the sources, count each issue once and draft the quarterly narrative, with every figure traced to its query.

How does it explain why residual risk moved?

The risk movement analyst compares residual scores between two quarters by market and risk area, then attributes the change to the control test or inherent rating that changed. For Brazil in the working solution, it shows two areas — distributors and public tenders — explaining the whole +2.0 rise.

Does it count the same issue twice if it comes through the hotline and an audit?

No. The De-duplication agent matches reports on party (tax ID or name), place, kind of allegation and a 45-day window, and links them to one issue. Matches below 0.85 similarity go to the market compliance lead, and every merge can be reversed.

What happens when a source is missing data?

The report says so. An empty query is written as “none” or “not available”, and nothing is averaged, carried over or estimated — a rule locked in Settings. In the working solution, Colombia’s missing September monitoring feed is reported as not available.

Can the agents change our risk scores or plans?

No. The agents have read-only access to the eight sources and draft, never approve. A new mitigation plan they propose goes to its owner to accept, and the chief compliance officer signs the report.

How is hotline reporter confidentiality protected?

Reporter identity stays in the hotline record; the agents see the allegation only. The investigations role is the one that sees hotline reporter details.

Can we set our own scoring and approvers?

Yes. The match window, the similarity below which a person confirms a merge, the control factors in the residual risk formula, the threshold for a High market, who signs the report, who reviews each market and where the approved report goes are all settings.

How long does it take to go live?

The Agentic Solution Engine builds and deploys it from your requirements — your risk methodology, your sources and a past quarter’s report — and it goes live once every quality gate has passed. We will walk you through it on a quarter of your own data first.

See it on
your quarter.

We’ll run Compliance Risk Narratives on a past quarter of your own risk scores and issue reports.