Skip to content
SPECIFICTION
Get listed

OrviQ

orviq.io

WebAPI
Visit orviq.io
Spec score 7.3 #11 of 22 in Internal Audit Software

What it is

OrviQ is an API and web enterprise governance, risk, and compliance platform linking regulatory requirements with internal controls and verified evidence. Its workflow moves from regulatory document ingestion and AI-assisted obligation extraction through requirement structuring, control mapping, assessment, evidence, findings, remediation, monitoring, and reporting. AI extraction remains advisory until a human reviewer accepts it. Control Assurance covers design and operating-effectiveness assessments, RCSA campaign waves, and second-line validation. Residual risk can be linked to assurance conclusions, KRI threshold breaches, and open audit findings. Modules cover regulatory compliance, risk management, findings and remediation, policy governance, audit, inspections, operational resilience, and third-party risk. The catalogue documents 20 available integrations, including Microsoft Entra ID, Okta, Azure, Microsoft 365, AWS, Google Cloud, VMware, ServiceNow, Jira, and GitHub or GitLab; Splunk and Microsoft Sentinel are planned only. Tenant isolation, centrally enforced permissions, append-only audit logs, encrypted credential storage, malware scanning, rate limiting, CSRF protection, and health checks are described. Pricing is on request and modules are licensed per tenant.

Spec sheet

Product
OrviQ is an enterprise Governance, Risk and Compliance platform connecting regulatory requirements to internal controls and verified evidence.Read 5 Oct 2026 · docs.orviq.io
Audience
The maker presents OrviQ as enterprise GRC and continuous assurance software for regulated institutions.Read 5 Oct 2026 · orviq.io
Deployment
Deployment architecture, data residency and private-infrastructure requirements can be assessed during enterprise solution design.Read 5 Oct 2026 · orviq.io
API
OrviQ documentation describes API keys for inbound programmatic access and webhooks for outbound delivery; these require the API Access entitlement.Read 5 Oct 2026 · docs.orviq.io
Integrations
The maker's integration catalogue documents 20 available integrations and two planned entries, Splunk and Microsoft Sentinel.Read 5 Oct 2026 · docs.orviq.io
Security
The maker states that tenant isolation is enforced at the data layer and role-based permissions are centrally enforced on every request.Read 5 Oct 2026 · orviq.io
AI
AI can suggest obligation extraction, but suggestions remain advisory until a human reviewer accepts them.Read 5 Oct 2026 · orviq.io
AI providers
The documentation describes hosted AI and bring-your-own-key modes, with provider options including OpenAI, Anthropic, Google Gemini, Azure OpenAI, Ollama and Replicate.Read 5 Oct 2026 · docs.orviq.io
AI review
AI extraction suggestions remain advisory until a human reviewer accepts them.Read 5 Oct 2026 · orviq.io
Assurance rules
The platform says only independently accepted work advances completion figures, and control owners cannot approve their own assessments.Read 5 Oct 2026 · orviq.io
Audience and access
The maker presents OrviQ for regulated institutions and offers a live demo and guided technical walkthrough by request.Read 5 Oct 2026 · orviq.io
Audit trail
The platform records actor identity, actions, before-and-after values and request context in an append-only audit log.Read 5 Oct 2026 · orviq.io
Available integrations
Listed available integrations include Microsoft Entra ID, Okta, Azure, Microsoft 365, AWS, Google Cloud, VMware, security scanners, ServiceNow, Jira and GitHub/GitLab.Read 5 Oct 2026 · docs.orviq.io
Compliance caveat
OrviQ describes its alignment with COSO Internal Control, Basel Committee PSMOR, NIST CSF 2.0 and other expectations as design intent, not a conformance or certification claim.Read 5 Oct 2026 · orviq.io
Control assurance
Control Assurance includes design and operating effectiveness assessments, RCSA campaign waves and second-line validation.Read 5 Oct 2026 · orviq.io
Core workflow
Its workflow covers regulatory ingestion, obligation extraction, requirements, control mapping, assessment, evidence, findings, remediation and reporting.Read 5 Oct 2026 · orviq.io
Credentials
Integration credentials are held in an encrypted vault and are never returned by the API.Read 5 Oct 2026 · orviq.io
Framework claims
OrviQ says its design references COSO Internal Control, Basel Committee PSMOR and NIST CSF 2.0, while disclaiming conformance or certification claims.Read 5 Oct 2026 · orviq.io
Integration limits
Splunk and Microsoft Sentinel are catalogue-only planned entries and are not operational in the current release.Read 5 Oct 2026 · docs.orviq.io
Modules
The modular GRC platform includes regulatory compliance, risk management, findings and remediation, policy governance, audit, inspections, operational resilience and third-party risk.Read 5 Oct 2026 · orviq.io
Pricing
The maker describes modules as licensed per tenant, but the pages reviewed do not state prices.Read 5 Oct 2026 · orviq.io
Regulatory workflow
The platform supports regulatory document ingestion, AI-assisted obligation extraction, requirement structuring, control mapping, assessment, evidence, findings, remediation and monitoring.Read 5 Oct 2026 · orviq.io
Risk management
OrviQ links residual risk to control assurance conclusions, KRI threshold breaches and open audit findings.Read 5 Oct 2026 · orviq.io
Security operations
The site lists malware scanning on uploads, rate limiting, CSRF protection and automated health checks.Read 5 Oct 2026 · orviq.io

Strong points and limits

Strong points

  • AI suggestions require human acceptance
  • Control effectiveness and RCSA assessments
  • Append-only audit trail
  • Encrypted integration credential vault
  • API keys and outbound webhooks

Limits

  • Two listed integrations are not operational
  • Pricing requires a request

Who it suits

OrviQ is presented for regulated institutions needing enterprise GRC and continuous assurance workflows. Deployment architecture, residency, and private-infrastructure requirements can be assessed during solution design.

Verdict

OrviQ connects regulatory work, controls, evidence, findings, and remediation with human review gates. Its modular scope and documented security controls suit regulated organizations evaluating a tenant-based GRC platform.

Where Specifiction places it

Alternatives to OrviQAll alternatives →