Compliance risk reporting where every figure in the quarterly narrative is a live query you can re-run
The quarterly risk narrative drafted in minutes, every figure from a live query
See one case, screen by screen ↓Every quarter the chief compliance officer tells the Compliance Committee where residual risk moved and why. The evidence sits in eight places with no shared keys: the risk assessment scores from the market workshops, control testing results, the speak-up hotline, internal audit findings, compliance monitoring alerts, the investigations case log, the mitigation plans and the third-party due-diligence register. The analytics lead and two analysts export each one, match the reports by hand and type the figures into Word and PowerPoint. For Q3 2025 that took about nine working days from data close to a draft.
The risk is in what hand matching misses. The same matter is counted once per channel, so a market looks like 23 problems when it is 14 and the real driver is hidden. A missing feed is papered over with last quarter's value or an average of other markets. And an approximate figure — “about 20 distributors overdue” — cannot be defended when the committee, the auditor or a regulator asks where it came from. The US DOJ's Evaluation of Corporate Compliance Programs, revised in September 2024, asks whether compliance has access to its data and uses analytics to find risk; a hand-assembled deck answers neither.
Estimated split for one quarterly report across 12 markets and six risk areas, by hand and with the solution; the time with the solution includes people checking the agents' work.
Six agents query eight sources, merge duplicate issues and write beside the lines; the chief compliance officer signs.
A global medtech manufacturer reports 12 markets across six risk areas — HCP engagement, distributors & agents, public tenders, grants & donations, hospitality & travel, demo & loaner equipment. Q3 2026 closed on September 30 and the Compliance Committee meets on October 15. Here is what happens next, screen by screen, in the working solution.
Lena's home is the movement itself: each risk area a line from Q2 to Q3 on the 1–25 residual scale, with the High band from 13.0 shaded. Brazil, compliance lead Rafael Souza, rose from 11.0 to 13.0 — distributors & agents 12 → 19 and public tenders 10 → 15 in red, the other four flat. Beside the lines the narrative is already written, sentence by sentence.
“Brazil’s residual risk rose from 11.0 to 13.0, the largest rise of the 12 markets (1 of 12); it is now rated High.”
The nightly refresh loaded the eight sources on Oct 5 at 22:00. The Query agent runs 214 read-only queries, the De-duplication agent resolves 121 reports into 83 issues, and the Risk movement analyst works out what moved and why. The lines start flat at Q2, move to Q3, and the steep rises turn red while the Narrative writer drafts.
“Q3 2026 drafted · 32 figures, each from a live query · 2 empty results reported.”
The writer explains the steepest move: 7 of 19 distributor due-diligence reviews were overdue at quarter end (Q2: 1 of 19), and the control is now rated Weak. Lena clicks 7 of 19 and the query opens under the narrative, against the third-party due-diligence register, 19 rows, run Oct 6 at 09:14. She re-runs it: same value.
The Query agent reads the sources read-only — it cannot change any score, issue or plan.
The last sentence for Brazil reads “Investigations closed in Brazil this quarter: None.” Its query over the investigations case log returned 0 rows, and the screen labels it an empty result, reported. In the same way, Colombia's September monitoring feed was not received, so its figure is written as not available.
An empty result is returned as empty — never a guess, an average of other markets or last quarter’s value.
The hotline, internal audit, monitoring and investigations sent 121 reports in Q3. Matched on party, place and kind of allegation within a 45-day window, they are 83 distinct issues: 38 duplicates merged, 31%. Six are under investigation, owner Omar Haddad. In Brazil, 23 reports resolve to 14 issues.
An anonymous hotline report (SPK-26-0917) passes on a claim by an Andara Distribuidora sales manager: the purchasing manager at Hospital Santa Clara is paid “marketing support” for every Corventa order. Spend monitoring found three credit notes to Andara coded that way, R$ 184,000 in total; internal audit found its effective margin at 22% against the 15% in its contract; an investigation (INV-BR-0412) is open. One issue, high severity, worded as an allegation.
“Matched by the De-duplication agent on party, place and kind of allegation within 45 days · similarity 0.94 · confirmed by Rafael Souza on Oct 2.”
Switching to all markets redraws the lines as averages of 12 markets and rewrites the narrative. Average residual risk moved from 8.8 to 8.9 and rose in 5 of 12 markets; distributors & agents rose most, 9.4 → 10.3, led by Brazil (12 → 19) and Mexico (13 → 15). Every figure still opens its query.
The quarterly report is written in five sections: what moved the risk, which issues drove it, mitigation status, where to focus and data notes. 42 mitigation plans are open and 6 overdue; Brazil's 15% distributor margin cap (MP-BR-09) is 6 days late. Where to focus says completing the distributor renewals would take the area from 19 to 12 — labelled a projection from the scoring rules.
“32 of 32 figures traced to a live query · 2 empty results reported as such.”
Lena approves the Q3 2026 report with the meaning “I approve this report for the Compliance Committee” and her password. Her name, the date and time and the meaning are recorded with the report, and approval locks this version.
The report moves from officer review to approved and is locked as version 1.0; any change now creates a new version. One click sends it to the Compliance Committee, nine days before the meeting on October 15.
“Approved and signed — report locked as version 1.0.”
The same quarter, seen by the five people who carry it — in their own words, and what changes.
Six agents query eight sources, merge duplicate issues and write beside the lines; the chief compliance officer signs.
Answers every number with one read-only query over the eight sources and returns the value, the query, the row count and the time it ran.
Finds hotline, audit, monitoring and investigation reports about the same matter — same party by tax ID or registered name, same place, same kind of allegation, within 45 days — and links them to one issue.
Explains why a market's residual risk moved: which risk areas, which control ratings, and the facts behind them.
Reads plan status and due dates, flags overdue actions and ranks where attention will lower residual risk most.
Links distinct issues to the risk areas that moved and ranks them by severity, recurrence and channel count.
Writes the sentences beside the lines and the five report sections for the Compliance Committee in plain words; every figure is filled from a Query agent result.
Approves and signs. The agents propose; a named person decides.
Ask in plain words — or say what to change. Every number in the answer is a live query.
Why did Brazil's residual risk go up?
Brazil rose from 11.0 to 13.0 (+2.0), the largest rise of 12 markets. Two areas explain all of it: distributors went 12 → 19 with 7 of 19 due-diligence reviews overdue, and tenders went 10 → 15 with 5 of 8 tender reviews passed.
Show me the high-severity issues from the hotline
Two are in Brazil — the Andara Distribuidora payments and the Sorocaba tender specification — one in Mexico and one in China. The issue list is filtered to them.
Add a focus action for distributor due diligence in Mexico
Added MP-MX-07 · Renew due diligence for Mexico distributors that ship to public hospitals, owner Lucía Romero, due Dec 15, as a proposed plan. It goes to Lucía to accept. Mexico distributors scored 15 this quarter (Q2: 13).
Which markets have overdue mitigation plans?
6 plans are overdue in 6 markets: Brazil MP-BR-09 margin cap, Mexico MP-MX-04 stop rebates, India MP-IN-05 travel approvals, China MP-CN-06 agent fees, United States MP-US-11 transparency fix and Italy MP-IT-03 loaner tracking.
13 screens from the working solution, on its sample data. Pick one to see it large.
How figures are produced, how reports are merged, how risk is scored and who signs are settings. Residual risk is inherent risk (likelihood × impact, 1–25) × a control factor: Strong 0.40 · Adequate 0.60 · Needs improvement 0.75 · Weak 0.95.
| Setting | Default | Choose from |
|---|---|---|
| Never estimate a missing figure | On | Locked by the compliance policy |
| Show the query behind every figure | On | On · Off |
| Count an issue once across channels | On | On · Off |
| Match reports within | 45 days | 30 days · 45 days · 60 days |
| Merges a person must confirm | Below 0.85 | Below 0.85 · Below 0.90 · All merges |
| A market is rated High from | 13.0 | 12.0 · 13.0 · 14.0 |
| Market deep dives reviewed by | Market compliance lead | Market compliance lead · Lena Ortiz |
| Send the approved report to | Compliance Committee | Compliance Committee · Compliance Committee and Audit Committee |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample quarter · “estimated” = our estimate · “typical” = published figures (NAVEX 2025 Whistleblowing & Incident Management Benchmark Report — 1.57 reports per 100 employees a year, global median, all channels; US DOJ Criminal Division, Evaluation of Corporate Compliance Programs, revised September 2024, on data access and analytics). People, companies, distributors, hospitals and case numbers named on this page are fictional — characters and sample data in the working solution.
Software that turns a compliance programme's data — risk assessments, control testing, hotline reports, audit findings, monitoring alerts, investigations, mitigation plans and third-party due diligence — into the periodic risk report for the Compliance Committee or board. Compliance Risk Reporting adds six agents that query those sources, count each issue once and draft the narrative, with every figure a live query, for the chief compliance officer to approve and sign.
Each risk area is a line from last quarter to this one on the 1–25 residual scale, with the High band shaded and steep rises in red, for one market or all of them. A risk map shows every market and area as a heatmap of this quarter, last quarter or the change. The narrative beside the lines explains which areas moved and the control rating or facts behind them.
The De-duplication agent links hotline, internal audit, monitoring and investigation reports about the same party, place and kind of allegation within the match window — 45 days by default — into one issue. Matches below 0.85 similarity go to the market compliance lead to confirm, and every merge is reversible and logged. In the sample quarter, 121 reports became 83 distinct issues.
Yes. Click any figure in a sentence and the query that produced it opens with its source, row count and run time; Re-run executes it again, read-only, and confirms the value. The figure check blocks a draft if any number has no query.
The report says so. An empty query is written as “none” or “not available” and never averaged, carried over or estimated — a rule locked in Settings. In the sample quarter, Colombia's September monitoring feed was not received and is reported as not available.
No. The agents read the sources read-only and never change a score, issue or plan. Allegations are worded as allegations, and a hotline reporter's identity never leaves the hotline record.
Yes. The agents draft and never approve. Market compliance leads confirm low-similarity merges and review their market's section, and only the chief compliance officer approves, by e-signature with its meaning. Approval locks the version; a change creates a new one.
The Agentic Solution Engine builds and deploys it from your requirements and documents — your risk assessment method, scoring rules, past committee reports and exports from your eight sources — and it goes live once every quality gate has passed. We will walk you through it on a past quarter of your own data first.
The right playbook for every market and product, built 70% faster.
1-min demoChargeback ProcessingEvery chargeback claim read first, each verdict with its rule and evidence
1-min demoPromotional Claims SubstantiationEvery claim tied to the page that supports it before MLR review
1-min demoWe'll run Compliance Risk Reporting on a past quarter of your own compliance data.