ControlHatch vs Resolver Investigations

ControlHatch is a web-based GRC platform for SOX compliance, internal controls, risk assessments, and operational audits. Teams can organize control testing by audit round, record exceptions, and capture reviewer sign-off in an audit trail. Its AI-assisted workflow drafts risks, controls, and assertions from process descriptions for users to review and refine. Risk dashboards score risks and link them to mitigating controls. Recurring monthly or quarterly certification campaigns can send reminders and record timestamped attestations. A dashboard tracks evidence requests and fieldwork status, with scheduled reminders for outstanding PBC items; teams can export fieldwork to their own Excel testing templates. ControlHatch says it supports more than 50 frameworks and standards, including SOX 404, SOC 1 and SOC 2, ITGC, ISO 27001, PCI DSS, and HIPAA. Listed security measures include end-to-end encryption, role-based access control, audit logging, and SHA-256 hashing of uploaded evidence. The free plan costs nothing and includes unlimited users, entities, projects, and controls, AI-assisted workflows, and full data export.

Resolver Investigations manages an investigation from intake and evidence through findings and resolution in a structured case file. The cloud product centralizes case documents, supports full-text search, and maintains chain of custody. Teams can configure templates, dynamic fields, investigation stages, and event-based assignments. Role-based permissions, automated alerts, and cross-department workflows support collaboration among groups such as legal and HR. AI-assisted text analysis extracts details from case notes and witness statements; dashboards and reports show case trends and performance. Pre-built integrations and an open API can bring security, HR, IT, and external data into a case view. Resolver Mobile supports incident submissions, file uploads, and offline saving for later submission. It currently displays English only and is limited to the Submit trigger and a specific anonymous incident submission form. Listed uses include fraud, workplace misconduct, whistleblower reports, cybersecurity incidents, financial crimes, HR matters, and supply chain irregularities. Pricing is on request and tailored to each organization’s scope, users, modules, and deployment needs.