Everything Coriqo does, so nobody has to ask.
One page instead of seven conversations. Every module in the product, grouped by what it's for — not by which team built it. If a module below doesn't have a "New" badge, it's been live and in use by design partners; "New" marks what shipped most recently.
Know what's running before you're asked to prove it.
The living register of every model and agent you run — including the ones nobody submitted for governance.
Model inventory
Every model your MRM program governs, with status, owner, and validation stage in one register.
Agent inventory
Agentic AI tracked the same way models are — same lifecycle, same evidence bar, no separate spreadsheet.
Shadow-AI discovery
Read-only scan of AWS SageMaker, Bedrock, and S3 that reconciles what's actually running against what's governed, and flags the gap.
Model & agent detail
One page per model or agent: identity, lifecycle, findings, evidence, lineage, and attestation status together.
Attestation status, inline
The newest committee decision and attestation coverage shown as a KPI right on the detail page — no separate screen.
Evidence-request ROI, inline
Median evidence-request turnaround and hours saved vs. a manual pull, rolled up and surfaced on the model itself.
Knowledge graph
Models, agents, datasets, and owners as one connected graph instead of siloed records.
Version lineage
Every version of a model traced from first submission through retraining to retirement.
The workflow a validator would actually run.
Structured review with a named reviewer, a challenge step, and nothing that reaches sign-off unsupported.
Review queue
What needs a human decision, queued with separation of duties enforced between preparer and reviewer.
Document approval
Adversarial challenge against the rulepack your workspace runs — SR 26-2 for banking, Joint Commission RUAIH cross-referenced to ONC HTI-1 for clinical AI — before any document counts as evidence.
Scope determination · SR 26-2 §II
Whether something counts as a model under §II is answered, not assumed. Three questions, and the record keeps the answers, the outcome, and the rule that produced it. Every out-of-scope result names what governs the asset instead — spreadsheet controls, change management, or your AI rulepacks. The determination, and every earlier one, sits on the model's own page.
Per-model validation cadence
The revalidation interval is set per model with a written reason and the name of whoever set it. §V prescribes no frequency, so the overdue list shows whether an interval was decided or inherited from the platform's old 365-day default. Set it from the model's page; a blank reason is rejected.
Rulepack-bound submit gates
A control blocks a submission only where an installed rulepack carries the obligation, and the message names the pack. A high-risk model with no fairness metrics is blocked in a workspace running NIST AI RMF or the EU AI Act pack; in one running the banking pack alone, the same gap is raised as an advisory readiness item rather than a block.
Control coverage
Which required controls are covered, by which evidence, for every model in scope.
Oversight gaps
Surfaces exactly where governance coverage is thin, before an examiner finds it first.
Attention dashboard
What needs a decision today, ranked — not a wall of everything that's ever open.
Findings tracker
Every finding from every review, its severity, and its remediation status in one governed record.
Ongoing monitoring
Continuous checks between full revalidations, not just a point-in-time review.
Operations view
The operational health of the program itself — throughput, backlog, aging.
Program dashboard
Model risk posture at a glance — inventory, open findings, the validation queue, and what's waiting on you.
Overdue & alerts
Overdue reviews and attestations surfaced before they become an exam finding.
A library that answers questions instead of just storing files.
Documents, requests, and correlations treated as governed evidence — searchable, citable, and pinned to a source page.
Documents & evidence library
Every artifact behind a model or agent, cross-document searchable — "ask across every document," not one at a time.
Document viewer
Every finding pinned to a verbatim quote on a cited page — click a finding, see the source.
Evidence requests
Requests to model owners tracked to close, with turnaround time recorded automatically.
Evidence correlations
Related evidence across documents surfaced automatically, then confirmed by a person before it counts.
CSV / Excel import
Bring existing model inventories and evidence in from the spreadsheets you already maintain.
Live system connectors
Read-only connections to the systems evidence already lives in — no re-keying, no runtime dependency.
Communications
Teams and email threads correlated into the governed record, so the discussion behind a decision is evidence too.
A record your reviewer can check without trusting you.
Every governance event lands in a tamper-evident, independently verifiable chain — checked against a public key, not your say-so.
Append-only event log
Every governance action — decision, sign-off, finding — written once and never altered.
Merkle checkpoints
The log is periodically sealed into a Merkle root, so any tampering after the fact is detectable.
Ed25519 signing
Checkpoints are cryptographically signed — verifiable by anyone with the public key, no account needed.
Key transparency
The signing key's history is itself logged and auditable, so key rotation can't be used to rewrite history quietly.
Checkpoint verifier
A standalone tool anyone — including your examiner — can use to verify a checkpoint independently of Coriqo.
Optional public anchoring
Anchor checkpoints publicly for verification that doesn't depend on trusting Coriqo's servers at all.
AI output verifier
Check any AI-drafted finding against its cited source — a separate step from verifying the checkpoint chain.
The meeting becomes part of the record.
Model risk committee decisions and board reporting generated from the same governed record — not reconstructed after the fact.
Committee decisions
Every model risk committee decision — approve, approve with conditions, return to developer — chained into the record.
Minutes → chained record
Invite Coriqo to the meeting; minutes become a governed, tamper-evident event instead of a standalone document.
Board reporting
Quarterly board report generated directly from the record, not assembled by hand each cycle.
Vendor-model review cadence
Due dates for third-party model reviews tracked and surfaced before they're overdue. SR 26-2 §VII covers vendor and other third-party products; the cadence itself is yours to set.
Built for the day the examiner — or the review committee — shows up.
A package and a portal built for the person on the other side of the table, not retrofitted from an internal screen.
These screens are named for whoever is reviewing you. A banking workspace sees examinations, examiner packages, and an examiner portal. A healthcare workspace sees the same screens labelled surveys, committee review packages, and a reviewing committee portal — the vocabulary is a per-workspace setting, not a different build.
Examinations
Active and past exams, their scope, and every request tied to each one — run the exam from one place.
One-click examiner package
Exam-ready export assembled from the governed record — not a scramble the week before the exam.
Examiner portal
A scoped, read-only view for the examiner themselves — no email attachments, no re-sharing risk.
Exam case IDs & email ingestion
Examiner requests tracked by case ID, with an email alias that files incoming asks straight into the record.
Regulatory packages
Packaged regulatory submissions beyond the exam package — built and versioned the same way.
Clears IT vendor review before it clears procurement.
Runs inside your existing identity, access, and deployment model — never a new trust boundary to explain.
Microsoft 365 / OIDC SSO
Single sign-on against the identity provider you already run.
Role-based access control
Preparer, reviewer, committee, and examiner roles enforced at the platform level.
Connector management
Manage every read-only connection to source systems from one screen — what's connected, what's in scope.
Schema-per-tenant isolation
Each workspace's data isolated at the schema level — not row-level flags in a shared table.
Private cloud / on-prem
Deployment options where policy requires data to stay off shared infrastructure.
Selectable rulepack per workspace
Which framework a workspace governs against is a tenant setting, not a rebuild. Banking runs SR 26-2; clinical AI runs RUAIH and HTI-1 over NIST AI RMF 1.0. Generative and agentic systems sit outside SR 26-2 under footnote 3, so they are governed against the NIST AI RMF and EU AI Act packs a workspace installs. Healthcare details.
Zero-retention AI
AI used for drafting and search doesn't train on your data and doesn't retain it beyond the request.
Citation-grounded AI drafting
AI drafts findings and summaries with every claim pinned to a source citation — no answer without a page to point at.
Named-person approval gate
No AI output becomes part of the record until a named person accepts or overrides it.
Want to see any of this on your own models?
The demo runs on illustrative sample data — walk a model from submission through committee to an examiner package.