Early access is open — third-party risk, findings and risk acceptance are live. Lock in your price
RegulaTrust Logo
RegulaTrust/Audit

Prove that your programme works

Test it, show nothing was rewritten, and tell clients what you do.

Get early access

Product screens show fictional firms and example data.

§ 1What it does
01

Run audits and independent reviews

The independent AML review the law requires, an ISO internal audit or a supplier audit use the same engagement model.

  • Programmes of tests imported from a workbook and copied into each engagement, so changing the library never moves work in flight.
  • Each test is prepared by one person and reviewed by another; a reviewed result cannot change without being reviewed again.
  • Sampling plans with an append-only log, evidence requests to colleagues, findings, and last audit’s findings closed only by a passing retest.
  • A report that is final once the engagement is reported; external auditors work in the same system with a role limited to their own work.

An AML/CFT independent review in progress: tests, requests and findings

02

Prove that nothing was rewritten

Every change is recorded in an audit trail chained by hash, so altering, reordering or removing an entry is detected.

  • Anyone with access can re-verify the whole chain at any time.
  • Entries read as sentences — who did what, to which record — with each changed field.
  • Filter by person, area and date, and export with a fingerprint of the file.
03

Evidence straight from your cloud accounts (in pilot)

  • Read-only connections to AWS, Google Cloud and Azure check settings such as multi-factor sign-in, logging, public storage and encryption, each day.
  • Results are attached to the controls they evidence; a result informs a control, and your firm still records the answer.
04

Tell clients and partners what you do

Every firm is someone else’s supplier.

  • A public trust page lists the frameworks you assess yourself against and your approved policies.
  • Nothing is published until you switch it on; the page says plainly that it reflects your own assessment, not a certification.
  • Optionally, the subprocessors that handle personal data, from your supplier register.

What a client sees

05

Reports for the board and the regulator

  • Saved and scheduled reports; colleagues get a notification and download signed in, so no list travels by email.
§ 2Questions

What people ask

Yes, with a role limited to their own work: recording results, signing off and raising findings.

Compliance Frameworks, controls, risk assessment, policies and incidents.Third-party risk Onboarding, screening, rating, approval and review of suppliers.Pricing Switch on only the parts you use.
Early access

Plan your next independent review in RegulaTrust

We onboard a small number of firms each month, personally.

We’ll email you about early access only. Unsubscribe anytime. See our privacy policy.

Or write to hi@regulatrust.com