Know what your vendors' AI is doing, and prove you checked.
Upload a vendor's SOC report. Coriqo finds the opinion, the exceptions and the controls the report says you must run, and cites the page for each. A person on your team accepts each finding, and the review is sealed so an examiner can check it without taking our word for it.
Every finding points to a page.
Coriqo reads the report and lists what matters in one table. Each row names the page it came from and quotes it, so you can open the PDF and check it yourself. Anything it cannot trace back to the text is dropped, not guessed.
- The auditor's opinion, and whether it is qualified.
- Each exception, with the control it relates to.
- Subservice organizations the vendor relies on.
- The controls the report expects your bank to run on its side.
- A person accepts each value before the review is sealed.
| Finding | What the report says | Page | Status |
|---|---|---|---|
| Opinion | Unqualified | p. 4 | Accepted |
| Exception | Access reviews: 2 of 25 samples late | p. 41 | Needs response |
| Subservice | Cloud hosting provider, carved out | p. 12 | Accepted |
| Your control | Review user access every quarter | p. 18 | To review |
Sample data, for illustration
Turn the vendor's expectations into your controls.
A SOC report lists controls the vendor assumes you operate, often called complementary user entity controls. For each one, you link a control you already run, have Coriqo write a draft control from the report's text, or mark it not applicable with a reason your examiner reads.
- Each expected control links to the page that states it.
- You decide which ones apply, and who owns them. A draft counts only once it has an owner and is made active.
- A meter shows how many you have taken on and how many are still open.
| Expected control | Page | Decision |
|---|---|---|
| Review user access every quarter | p. 18 | Linked to AC-04 |
| Approve changes to API keys | p. 19 | Draft, no owner yet |
| Monitor the vendor's status page | p. 19 | Not applicable, with reason |
Sample data, for illustration
One table of vendor AI, and a record they can verify.
Mark a supplier as using AI and each AI product it supplies gets a row: the newest SOC review, what the supplier disclosed under SR 26-2 section VII, and any signed answers from the vendor. The table goes into the sealed package for your examiner, so a later change shows up as a change.
- Supplier, product, SOC review, disclosure and vendor answers on one row.
- The sealed review can be checked without a Coriqo login.
| Supplier | Product | Latest SOC review | Section VII |
|---|---|---|---|
| Northwind Data | Fraud scoring model | Sealed, 2 exceptions | Disclosed |
| Fabrikam AI | Document reader | Sealed, clean | Withheld, control in place |
| Contoso Cloud | Chat assistant | No review yet | Not asked |
Sample data, for illustration
Stated limits.
Coriqo does not
- Score your vendors or rank their risk.
- Replace reading the report. It points you to the pages that matter.
- Decide whether a vendor is acceptable.
You keep
- The conclusion about each vendor. It is yours.
- The choice of which expected controls apply to you.
- The right to disagree with what Coriqo extracted.
More on limits: known limitations.
Start with one vendor report.
Upload it and see what Coriqo finds, with the page for each item.