AI-assisted generation
The AI suggests risk types, suppliers, processes, risks (including KRIs) and tasks in the context of industry, country, regulator and framework(s) — including from uploaded documents.
View on the platform →Feature catalog
All Goveron features
The complete, filterable catalog of every Goveron feature, from guided structure setup through AI-assisted generation and risk scoring to evidence workflow, monitoring and reporting.
101 features across 18 areas
Core features
The 6 features that define Goveron
Two-stage risk scoring
Every risk gets an inherent risk from likelihood × impact, plus a two-stage residual risk: pre-audit from the weighted completion level of its tasks, post-audit based only on accepted or auditor-confirmed evidence.
View on the platform →Evidence & audit workflow
A piece of evidence moves through six clearly defined states — from upload and AI pre-review (accepted/rejected/inconclusive) to independent confirmation or rejection by the auditor.
View on the platform →KRIs, CRIs & early warning
Key risk indicators with a value and a target trigger an alert on threshold breach; external KYC and monitoring events additionally raise critical risk indicators and feed directly into risks, tasks and reports.
View on the platform →Versioning & audit integrity
Every save writes its own immutable version with editor, timestamp and audit flag; when an auditor opens a project, the system automatically freezes the current state as a baseline.
View on the platform →Dashboard & reporting
A dashboard brings together metrics on departments, processes, risks, tasks, evidence and KRIs, complemented by exportable risk and department reports and a network graph running from department to supplier.
View on the platform → Company Profiles & Projects
Reusable company profile
A company structure built once (industry, country, language, scope, suppliers, departments, processes) reused across many regulatory assessments.
Project
An assessment of a company against one or more frameworks; framework-specific data lives exclusively on the project.
Audit-safe snapshot
On creation, the company structure is deep-copied into the new project — later changes to the company never touch existing projects.
One company → many projects
For example, one project each for GwG, ISO 27001 and DORA, all built on the same structure.
Workspace hub
A central overview of "Your companies" + "Your projects" with create, open, export and delete.
Project identity
An inline renameable project name, plus a way to switch back to the hub from the sidebar.
Workflow Board & Switchboard
Four-block switchboard
The project home maps the entire journey: Company · Project setup · Operations · Results — each row jumps straight to the matching step or report.
Guided "next up" status
The board shows the next sensible step, or "all done," guiding you through setup and day-to-day work.
Guided Wizard & Structure Setup
10-step wizard
Industry → country → region → framework → risk types → suppliers → departments → processes → risks → tasks.
Context-aware navigation
Company profiles run through 5 steps, projects all 10 — navigation and header adapt accordingly.
Multi-framework selection
Multi-select via chips (ISO 27001, DORA, GDPR, GwG, GlüStV, AMLDs …), fuzzy-matched.
Structure depth & department cap
During company setup, Focused / Balanced / Broad plus a department slider control both the breadth AND the speed of structure generation — fewer means faster.
Budget-driven generation
A total row budget plus a department cap; distribution follows compliance risk intensity — hotspots get more rows.
Selectivity control
Focused / Balanced / Broad control materiality — both how critical the model's suggestions are and the volume level per department.
Confirm/unlock logic
Master data fields carry confirm/unlock; freely entered custom values are adopted verbatim.
AI-Assisted Generation
Structure generation
AI suggests risk types, suppliers, processes, risks (including KRIs) and tasks in the context of industry, country, regulator and framework(s).
Sequential generation with progress
Per-department calls run behind a blocking progress modal with live findings; canceling offers "keep partial result vs. discard."
Speed & parsing robustness
Materiality-dependent volume caps per department keep calls compact (~20–30s) and parsable; a 60s timeout per call prevents one stuck department from blocking the whole run.
Robust output parsing
Recovers even truncated or malformed AI responses (multiple retries) and works offline with a static fallback.
Auto-generation guard
Generation only fires on a truly empty, never-saved list — never on imported data or existing versions.
Task↔risk many-to-many
Tasks are generated per risk, deduplicated by name, and their risk links are merged.
Supplier auto-matching
Processes are matched to the right supplier via keyword overlap.
Provider abstraction
Claude for public regulatory content; an EU/private model for personal KYC/monitoring data.
Document analysis
Uploaded document → AI suggests additional risks and tasks, the user selects which to keep.
Master Data & Editable Structure
Full editability
Rename, delete, reorder, add your own entries, upload your own lists, compare against AI suggestions, accept or reject.
Departments · processes · sub-processes
A hierarchical structure; sub-processes override the parent process's values for scoring.
Risks with KRIs
A risk with short name, type, likelihood/impact and key risk indicators.
Tasks
Mitigating tasks with status, note, evidence and a many-to-many link to risks.
Risk type taxonomy & suppliers
Maintainable lists; suppliers carry service descriptions that feed process matching.
Structure for a new department
A complete structure can be generated for a department added after the fact.
Referential integrity on delete
Cascading cleanup of orphaned links with clear confirmation dialogs.
Timestamp audit trail
createdAt/modifiedAt on the project and every row, stamped centrally and content-aware.
Risk Scoring
Inherent risk
Likelihood × impact with scale-relative bands (Low/Medium/High/Critical).
Residual risk (pre-audit)
Inherent × (1 − mitigation), derived from the weighted completion level of the linked tasks.
Residual risk (post-audit)
Same formula, but only AI-accepted or auditor-confirmed evidence reduces the risk.
Scalable 3/4/5 rating scale
Fixed per project; bands and normalizations scale automatically with N².
Process risk score
Calculated per department from staff, IT systems, suppliers, complexity and automation.
Supplier criticality
Weighted scoring per supplier based on the processes they run, banded relative to the maximum.
Evidence & Audit Workflow
Evidence upload per task
Upload (png/jpg/webp/pdf/txt/md/csv/doc/docx), write a statement, or submit — deliberately without AI in this dialog.
AI evidence analysis
Returns accepted / rejected / inconclusive plus a rationale and a PII flag, including a placeholder guard and a "to accept" checklist.
Evidence document generator
AI creates an audit-ready Word template per task (including evidence to attach), versioned under "Evidence templates."
GDPR protection
File bytes are never persisted; when personal data is detected, only the review verdict is retained.
Auditor decision
Confirm (even without a file) or decline with a mandatory due date; overdue declined tasks are flagged.
Six evidence states
none / accepted (AI) / rejected (AI) / inconclusive / confirmed (auditor) / declined (auditor).
Monitoring & KYC Integration
Inbound event API
A single POST /api/v1/events endpoint — one-way (systems → Goveron), idempotent, with a bearer key per source system.
riskRef slug mapping
Stable slugs survive every risk regeneration and are mapped to real risk IDs.
Event impact
Events raise KRIs, create and trigger case tasks, and feed auto-evidence into the post-audit score.
Human-confirmed "suspicious" status
Kept separate from the AI's suspicion — with fields suspicious, reason, at and confirmed_by.
Two triggers
A monitoring case flagged "suspicious," plus a KYC block (block_user/oasis/oasis_24h, 72h SLA breach).
No raw PII
Pseudonymous IDs, masked labels and a secure deep link back into the source system.
KRIs, CRIs & Alerts
Key risk indicators
KRIs per risk with a value and a target, defined only where clearly meaningful (budget ≈ 10 per company, max. 2 per risk).
Alerts on threshold breach
Exceeding or falling below the target triggers an alert and highlights the affected indicator.
CRIs from monitoring events
External KYC/monitoring events raise critical risk indicators and feed through to risks, tasks and reports.
KRI list in the dashboard
All risk KRIs collected with value/target as a central early-warning overview.
Feed binding & recalculation
A KRI can be bound to a data source and recalculated automatically with every new data delivery.
Financial/Commercial KRIs from the BWA
Requirement-driven
The frameworks determine which commercial indicators are material — they appear even before any BWA, in a "waiting for BWA" state.
DATEV BWA parser
Deterministic detection of the reporting-month column via the annual overview, prior-year comparison and ZM counterparties for concentration risk.
Indicator catalog
Gross margin, personnel cost ratio, operating result margin, total cost ratio, revenue YoY, material cost ratio and receivables concentration risk.
Threshold logic
A floor (≥) or ceiling (≤) per indicator with clear breach detection.
Mapping at the company level
A single chart-of-accounts mapping serves all projects; the monthly BWAs and calculated values live on the project.
KRI feed, not new creation
Existing risk KRIs are bound to a BWA metric and recalculated on every upload — the BWA doesn't create new KRIs, it feeds them.
Versioned BWA as an audit trail
Every monthly BWA is stored as a document version (category "Financial reports (BWA)") — re-uploading a period appends a new version.
Dashboard & Reporting
Dashboard
Metrics on departments, processes, risks, tasks, completion, evidence, risk reduction, distributions, supplier ranking, KRIs, heatmaps, CRIs and framework readiness.
Risk report
One flat row per risk × mitigating task, filterable and exportable as CSV.
Department report
A single department or an overall view with metrics, processes, risks and tasks.
Network graph
A 7-column graph — departments → processes → risk types → risks → tasks → policies → suppliers — with hover tracing.
Heatmap & process KPIs
A risk heatmap plus complexity, automation and dependency metrics.
Stress test
A dedicated view for running through stress scenarios.
In-app KPI explanations
Every dashboard formula is documented directly inside the app.
Statement of Applicability & Framework Coverage
Runtime catalog discovery
The control structure is determined via chunked discovery, never hardcoded (e.g. all 93 ISO 27001 controls).
Catalogue mode
With a fixed standard, every control is shown as covered/gap by matching task-control references.
Materiality mode
Without a fixed catalog = the share of risks with at least one live mitigating control.
Gap generation
AI drafts a mitigating control for each uncovered control or risk, mapped and merged in.
Budget/cost warning
A catalog must be fully covered — row costs against budget are flagged before drafting begins.
Confidence-gated references
A precise control ID or paragraph is only cited when certain, otherwise left blank.
Policies & Documents
Policy register
An expandable table with a detail drawer: purpose, controls governed, regulatory references, template section.
Policy document generator
AI drafts a sample policy matching scope + framework, versioned under "Policy templates," returned as a download and as evidence.
Versioned document store
Every entry keeps an ordered version history; an upload adds a version, it never overwrites.
Permissions
Owner/department: upload + download (no delete); admin: delete; auditor: read-only.
In-memory bytes
GDPR-consistent: file bytes are never persisted; after a reload the metadata remains, the bytes are gone.
Benchmarking
Market-entry estimate
How well the home-market infrastructure fits a target country + regulator + framework(s) — explicitly flagged as a rough estimate.
Deterministic + AI refinement
A heuristic base match; AI refinement is only accepted if it covers at least half of the departments.
Effort & grade output
Additional staff/IT systems/suppliers per department, an overall grade (Strong → Minimal) and CSV export.
Import / Export
Full project export/import
A JSON file; import accepts either a whole project or a single version file.
Versioning & Audit Integrity
Full-project snapshots
Curated customer work is protected from AI overwrites through snapshots.
Versioned storage
Every save writes a version with editor, time, audit flag, data and three scores; older versions are read-only.
Audit baselines
When an auditor opens a project, the system freezes any drifted lists as a baseline version.
AI lock
After finalization, AI suggestions must be manually approved.
Master data & name lock
The first process save locks master data for non-admins; risk names lock after their first save.
Role-Based Workspaces
Project owner
Runs the full guided wizard for their own project.
Department user
Restricted to their own department, can edit but not delete, Essentials view, same day-to-day navigation.
Auditor
Read-only except for evidence, lands on the tasks, freezes an audit baseline on opening.
Admin
Full access via the admin console, including all projects.
Platform & UX
Two themes (dark/light)
Switchable live; all global styles rebuild instantly.
Content language
AI-generated content can be produced in the local language, while the interface stays in English.
Save / autosave contract
Edit locally up to the first save; after that, every change persists immediately.
Per-page help system
Structured guidance for every page, including admin tabs, with a clear "not legal advice" notice.
Styled confirmation dialogs
Every destructive action runs through a single, consistent dialog that lists the resulting cascades.
AI typeahead fields
Background fetch with a skeleton state, "use your own value," a cancel row, and a timeout fallback to static lists.
Click-to-cycle chips
Cycle through status, relevance, complexity and automation with a click.
Essentials & advanced view
A switchable level of detail — day-to-day work vs. full control.