RegAlign® + RiskAlign®
Obligations-up meets risks-down.
RegAlign® starts with regulatory requirements; RiskAlign® starts with objectives and enterprise risks. They meet at controls and evidence but keep separate records. RegAlign and RiskAlign are being prepared for release together first. Before a firm uses either product, we confirm that the features, jurisdiction, integrations and setup it needs have been tested for that use.
Pick RiskAlign if…
- Your board asks "are we operating inside appetite?" and you can't answer cleanly.
- Your risk register is in a spreadsheet, residual scores are inconsistent, and KRIs aren't linked to risks.
- You need scenario analysis (stress, reverse-stress) you can explain through evidence and assumptions.
- Three-lines accountability isn't visible — first line owns risks, second line owns oversight, third line owns assurance, and nobody can see the seam.
Pick RegAlign if…
- Your problem starts with "the regulator just published…" and ends with "…can we prove we comply?"
- You need an obligations register with chain-of-custody, not a risk register.
- Regulatory change tracking, horizon scanning, and attestation workflows are the headline pain.
- You want to see which control and evidence relate to each rulebook clause.
Pair them if…
You're a regulated firm where both disciplines exist. Each product keeps its own control register. Information moves only through the defined exchange: today the verified route is a CSV exchange that can carry obligation and control references. There is no automatic shared live database. See how they fit together.
Side by side
| RiskAlign | RegAlign | |
|---|---|---|
| What's the starting point? | What could hurt the firm — strategic, operational, conduct, financial risks. | What the regulator requires — handbooks, rulebooks, supervisory letters. |
| Primary user | CRO, risk owners, board risk committee. | Compliance officer, regulatory change team, MLRO. |
| Core unit of work | A risk, with appetite, controls, KRIs and scenarios. | An obligation, with mapped controls and evidence. |
| Scoring model | 5×5 inherent → residual, plus velocity and persistence. | Coverage and freshness against the obligations register. |
| Board output | Risk pack: heatmap, appetite breaches, KRI trend, top issues. | Compliance pack: obligation coverage, regulatory change pipeline, attestations. |
| Regulatory change | Not handled — RiskAlign assumes the obligation set is given. | Native — ingest, triage, assign, attest. |
| Risk appetite & KRIs | Native — board appetite per category, KRI thresholds, breach alerts. | Not handled — RegAlign assumes risk appetite is set elsewhere. |
| Audit trail | Per-risk and per-decision, with chain-of-custody on residual changes. | Per-obligation, with chain-hash on every state change. |
Start with the sharper problem.
Most firms only need one of the two to start. Pick the product that solves the sharper problem first; consider the other if you need both. They keep separate records; defined references can move between them by CSV exchange.