Bring the control spreadsheet you already have.
For regional model risk, internal audit and vCISO firms that run controls for several banks, credit unions or fintechs. Upload your Excel or CSV with your own column names. Coriqo shows how it read the file, you fix what is wrong, and nothing is saved until you confirm. Then keep one library and apply it to each client.
Firms that run controls for more than one client.
You already have a control set you take from client to client. Coriqo keeps it in one place and records what you applied where.
Regional model risk firms
You review models for banks and credit unions that have no validation team of their own. Keep the controls you bring to each review in one library and apply them per client.
Audit firms
You run outsourced or co-sourced internal audit. Each import is locked in the client's record with the file's fingerprint, and each library apply names the consultant who made it, so you can show what came in and when.
vCISO firms
You run the SOC 2 or ISO 27001 program for fintechs and smaller banks. Bring the control list you already use, and evidence requests start only when the client confirms.
From your spreadsheet to a client's control list.
Most tools ask you to retype your library into their format. This one reads your file as it is.
Drop the file
An Excel or CSV file, with your own headings. A template is there if you want one, and you do not need it.
Check the column matches
Coriqo guesses which column is the control ID, the title, the owner, how often it runs and the SOC 2 or ISO 27001 reference. You change any guess from a dropdown. The next file with the same headings is matched for you.
Read the review before anything is saved
You see how many controls are new, how many update one you already have, and which look like starter controls Coriqo ships. For each look-alike you choose to link it, keep both, or skip it. A reference such as CC6.1 or ISO 27001 5.15 is resolved for you, and if it could mean two things you pick. A row with a problem says what is wrong and how to fix it, and nothing is saved while any row is broken.
Write
The controls arrive as drafts. The import is locked in the client's record with the file's fingerprint, the row count and the column matches, so you can show a client exactly what came in.
Start collecting, in one confirmed step
Coriqo offers to activate the imported controls, turn on evidence requests, open an audit period and email each owner a list of what they own. Nothing runs until you confirm, and each step reports what it did or why it skipped.
Take it back out
Controls export to a spreadsheet in Coriqo's column layout, so you can always take your controls with you.
Keep your standard controls once. Apply them to each client.
If you work with several clients, you should not have to upload the same file into each workspace.
Lives in your workspace
The library holds control text, framework mappings and owner roles. It never holds a client's data.
Versions that do not change
A published version is fixed. A change is a new version, so a client's record always points at one exact set of controls.
Preview, then apply
Applying to a client shows every row first. New controls arrive as drafts, each marked with the library and version it came from.
Updates are offered, never pushed
When you publish a new version, you see which clients are behind and apply the update row by row. A field you tailored for one client is kept unless you choose to overwrite it.
The client stays in charge.
A bank decides what a consultant can write into its workspace.
A switch they control
The client's admin can turn off consultant libraries. Controls already applied stay.
Grants need their opt-in
If you reach a client through a Manage grant rather than by owning the workspace, you can apply a library only after the client turns that on.
Drafts only
Nothing becomes active until a person at the client confirms it, and a second approver can be required.
Locked and named
Each apply is locked in the client's record and names the consultant who made it.
What this does and does not do.
What Coriqo does
- Reads your spreadsheet with your own column names and shows how it read it before saving
- Matches controls to SOC 2 and ISO 27001 items, and flags look-alikes of its starter controls
- Locks each import and each library apply in the client's record
- Starts evidence collection only when a person confirms
What it does not do yet
- Keep your own column order or formatting on export. It exports in Coriqo's layout
- Lock an import in a workspace that has no model or agent registered. Those imports go in the audit log only, and the screen says so
- Show a client a notice that your library has an update. Only you see that
- Edit library items in the browser. You change a draft by uploading a file
Coriqo does not issue a SOC 2 report or an ISO 27001 certificate, and it does not decide whether a control is effective. That stays with the bank and its auditor.
Before you try it.
Do my column names have to match yours?
No. Coriqo suggests a match for each column and you change any of them from a dropdown. If you leave out a column, that data is not imported.
What if some rows are wrong?
The review lists each problem with the reason and the fix. Nothing is saved until every row passes, so a bad file never half-imports.
Can a client see my library?
No. Your library stays in your workspace. A client sees only the controls you applied to them, each marked with the library and version it came from.
Which plan includes this?
We have not set that yet. Tell us how you work and we will say what fits. Plans and prices that are set are on the pricing page.
Try it with a file you already have.
Start with one client and one spreadsheet. Or walk through it with us on a call.