OrviQ
What it is
OrviQ is an enterprise governance, risk and compliance platform that connects regulatory requirements with internal controls and verified evidence. Its workflow spans regulatory document ingestion, AI-assisted obligation extraction, requirement structuring, control mapping, assessment, evidence, findings, remediation, monitoring and reporting. AI-generated extraction suggestions remain advisory until a human reviewer accepts them. The modular platform covers regulatory compliance, risk management, findings and remediation, policy governance, audit, inspections, operational resilience and third-party risk. Control Assurance includes design and operating effectiveness assessments, RCSA campaign waves and second-line validation. The platform links residual risk to assurance conclusions, KRI threshold breaches and open audit findings; control owners cannot approve their own assessments. Available integrations include Microsoft Entra ID, Okta, Azure, Microsoft 365, AWS, Google Cloud, VMware, security scanners, ServiceNow, Jira and GitHub/GitLab. The maker presents OrviQ to regulated institutions and offers a live demo and guided technical walkthrough by request. Modules are licensed per tenant, with pricing on request. API keys and webhooks require the API Access entitlement.
For and against
For
- AI extraction suggestions require human acceptance
- Control owners cannot approve their own assessments
- Includes risk, audit and remediation modules
- Documents 20 available integrations
Against
- Pricing is available on request
- Two catalogue entries are planned, not operational
- API keys and webhooks require API Access
The verdict
OrviQ brings regulatory obligations, controls, evidence and remediation into a modular GRC workflow. Its AI suggestions require human acceptance, and pricing is available on request.
Who it suits
It suits regulated institutions seeking enterprise GRC and continuous assurance software. The maker offers a live demo and guided technical walkthrough by request.
On the record
- AI
- AI can suggest obligation extraction, but suggestions remain advisory until a human reviewer accepts them.orviq.io · read 5 Oct 2026
- AI providers
- The documentation describes hosted AI and bring-your-own-key modes, with provider options including OpenAI, Anthropic, Google Gemini, Azure OpenAI, Ollama and Replicate.docs.orviq.io · read 5 Oct 2026
- AI review
- AI extraction suggestions remain advisory until a human reviewer accepts them.orviq.io · read 5 Oct 2026
- API
- OrviQ documentation describes API keys for inbound programmatic access and webhooks for outbound delivery; these require the API Access entitlement.docs.orviq.io · read 5 Oct 2026
- Assurance rules
- The platform says only independently accepted work advances completion figures, and control owners cannot approve their own assessments.orviq.io · read 5 Oct 2026
- Audience
- The maker presents OrviQ as enterprise GRC and continuous assurance software for regulated institutions.orviq.io · read 5 Oct 2026
- Audience and access
- The maker presents OrviQ for regulated institutions and offers a live demo and guided technical walkthrough by request.orviq.io · read 5 Oct 2026
- Audit trail
- The platform records actor identity, actions, before-and-after values and request context in an append-only audit log.orviq.io · read 5 Oct 2026
- Available integrations
- Listed available integrations include Microsoft Entra ID, Okta, Azure, Microsoft 365, AWS, Google Cloud, VMware, security scanners, ServiceNow, Jira and GitHub/GitLab.docs.orviq.io · read 5 Oct 2026
- Compliance caveat
- OrviQ describes its alignment with COSO Internal Control, Basel Committee PSMOR, NIST CSF 2.0 and other expectations as design intent, not a conformance or certification claim.orviq.io · read 5 Oct 2026
- Control assurance
- Control Assurance includes design and operating effectiveness assessments, RCSA campaign waves and second-line validation.orviq.io · read 5 Oct 2026
- Core workflow
- Its workflow covers regulatory ingestion, obligation extraction, requirements, control mapping, assessment, evidence, findings, remediation and reporting.orviq.io · read 5 Oct 2026
- Credentials
- Integration credentials are held in an encrypted vault and are never returned by the API.orviq.io · read 5 Oct 2026
- Deployment
- Deployment architecture, data residency and private-infrastructure requirements can be assessed during enterprise solution design.orviq.io · read 5 Oct 2026
- Framework claims
- OrviQ says its design references COSO Internal Control, Basel Committee PSMOR and NIST CSF 2.0, while disclaiming conformance or certification claims.orviq.io · read 5 Oct 2026
- Integration limits
- Splunk and Microsoft Sentinel are catalogue-only planned entries and are not operational in the current release.docs.orviq.io · read 5 Oct 2026
- Integrations
- The maker's integration catalogue documents 20 available integrations and two planned entries, Splunk and Microsoft Sentinel.docs.orviq.io · read 5 Oct 2026
- Modules
- The modular GRC platform includes regulatory compliance, risk management, findings and remediation, policy governance, audit, inspections, operational resilience and third-party risk.orviq.io · read 5 Oct 2026
