Your security controls, matched to SOC 2 and ISO 27001 and checked against your own records.
Write each control in your own words and say which SOC 2 and ISO 27001 items it answers. Coriqo checks it against the records your systems already keep, then locks the result. Your auditor can see that nothing was changed afterwards, without taking Coriqo's word or your team's spreadsheet for it.
What the catalog holds today.
These are the framework items and starter controls Coriqo includes today. The numbers come from the catalog Coriqo publishes.
SOC 2 Trust Services Criteria
Loading the count.
ISO/IEC 27001:2022
Loading the count.
Starter controls
Each starter control loads as a draft. Nothing is checked until an admin turns it on.
Loading the catalog.
Checks that have run on real data
None yet. The first checks are being tried now: change approval from GitHub and Jira, and access review from Microsoft 365. Each one will be listed here by name once it has run on real data.
Pick a starter control. See which SOC 2 and ISO 27001 items it answers.
Each starter control is mapped to the SOC 2 criteria and ISO 27001 Annex A controls it helps answer. These mappings are a starting point. Your admin can add or remove items for your bank.
Loading the starter controls.
Pick a control on the left to see its mapping.
Check a control test yourself.
Each test looks at a set of records, such as every account with access during one quarter. Coriqo locks a fingerprint of that set together with the result. If any record changes later, the fingerprint stops matching. Try it below.
Quarterly access review, Microsoft 365, period ending 30 June 2026
Five made-up accounts. They show how the check works. They are not a real bank's records.
| Record | Role (sample) | Record fingerprint |
|---|---|---|
| SMP-001 | Loan operations | ccfa5ea5cb04171324d555fb4ed21f679b8b42559a683e584c386021e64389ef |
| SMP-002 | Deposit operations | 790c4b204084ff2d80fbadcd5e79db553112143b0ccc5b2c54b97e55669742ad |
| SMP-003 | Core system admin | 92b207e4164719b8c874a70544f7d0d5789627a278890d9c19da8eb65f118f34 |
| SMP-004 | Credit analyst | 67a3f34e81a42879ffb758aeee192a9a06e8b0df62928bf24489340d56db6e30 |
| SMP-005 | Branch teller | 4ea02b99342c739aac8df6bc1dcf4c233427cbde96678f9d2edafa63038d4641 |
Fingerprint of the whole set, locked when the test ran: bf809f679fdc4343a93dfb63e88a2d29a1ea1d5fa405db56add50a796033b4fa
Not checked yet. Press the button to check.
Your browser works out the fingerprint from the five records above. Nothing is sent anywhere.
Your controls, your wording, your sample sizes.
Coriqo ships defaults for frameworks, starter controls, test procedures and sample sizes. Your admin can change any of them from the screen. No developer is needed and nothing is redeployed.
Add a framework
Load a framework your examiner uses, such as NCUA guidance, GLBA Safeguards or an internal policy. Give it its own items and ids, by form or from a spreadsheet.
Use your own wording
Replace Coriqo's summary of any SOC 2 or ISO item with your bank's own text, or paste the ISO text your bank has licensed.
Add fields and rename labels
Add custom fields of any type to a control. Rename field and status labels so they match the words your policy uses.
Change sample sizes
Set how many records a test looks at for each schedule, and how many problems it allows before it fails.
Edit the starter set
Load the starter controls, then edit, retire or add to them. Each one stays a draft until you turn it on.
Every change is recorded
A change writes an audit entry with who made it, the old value and the new value. Tests that ran before the change keep the settings they ran under.
Your suppliers, and every review you did of them.
An examiner will ask which vendors touch customer data and when you last reviewed each one. Coriqo keeps the supplier list as sealed records. Editing a supplier adds a new version, and the old one stays on file.
Review dates from your policy
You set how often each criticality level gets reviewed, for example every year for critical suppliers and every two years for low. Each supplier then reads Current, Due soon or Overdue.
The old list stays
Edits and offboarding add a sealed record instead of overwriting one. You can show what the list said, and who changed it, on any past date.
Answers the vendor signed
An AI vendor answers a standard set of due-diligence questions once and signs the file with its own key. Every bank that uses the vendor can check the same signature, so the vendor answers once instead of once per bank.
What a signature proves
It proves the file has not changed since the vendor signed it. It does not prove the answers are true. It also does not prove who holds the key, unless we checked that and recorded how. The screen says which.
A new key gets questioned
If a vendor's next file is signed with a different key, Coriqo stops and asks you to confirm with the vendor first. A new key can mean a rotation, or a file that did not come from the vendor.
Old answers expire
Each signed file carries an end date. After it passes, the supplier marks the answers as expired. If the vendor withdraws them, your copy stays and the screen says why.
Every duty, with the clause it comes from.
Coriqo lists the duties in the regulations you track, each with its clause citation. Map a duty to the control that meets it, and the screen shows whether current evidence backs that claim. Today the list holds the EU AI Act, ONC’s HTI-1 rule and the US interagency guidance on third-party relationships. You can read it without an account.
Track what applies to you
Pick the regimes that apply to your company. Each one shows how many duties it holds and how many are met or a gap.
Map a control to a duty
On any duty, record which control meets it, its status and your reasoning. A duty with nothing mapped reads Unassessed, which is not a finding against you.
Coverage needs evidence
A mapped control with nothing current behind it reads No current evidence. A control that was assessed and falls short reads Gap.
Text changes get a re-check
If a regulation’s wording changes after you said a control meets it, the duty is flagged so someone checks the claim against the new text.
What one update changed
Each refresh of the text lists the duties that newly apply, the ones with no coverage yet and the models affected. Turn an uncovered duty into a finding with an owner and a due date.
Reference, not legal advice
Coriqo does not decide whether you meet a regulation. It lists duties and the evidence you mapped. Read each duty against the regulation before you rely on it.
Not your SOC 2 report, not your ISO certificate, not your auditor.
A CPA firm issues a SOC 2 report after an examination. An accredited certification body issues an ISO 27001 certificate after an audit. Coriqo does neither. It holds the controls, the tests and the locked records that your auditor examines.
What Coriqo does
- Holds your control list, the framework items each control answers, and the owner of each control
- Checks the records you pick and locks each result with a fingerprint of those records
- Shows which controls have a test result for the period and which do not
What Coriqo does not do
- Issue a SOC 2 report or an ISO 27001 certificate
- Decide whether a control is effective, or tell you that you pass a framework
- Replace your auditor's testing, sampling or judgment
Give an auditor one engagement, not your whole workspace.
An auditor works from the request list, the control tests and the locked records behind each result. Their access covers one engagement: the controls in scope, the periods and the requests.
Scoped access
An auditor sees one engagement. Controls outside it stay out of view.
Their own result per test
An auditor can record an independent result beside the bank's result. The two are kept apart.
Request list tied to controls
Each request links to the control it tests, so the answer has a place to go.
Tests they can check again
Every test shows the records it looked at and their fingerprint. An auditor can work both out again.
Start with one control and one test.
Load the starter set, turn on the controls you run, and see the first test locked. Or walk through it with us on a call. Plans and prices are on the pricing page.