Audit-Ready Risk Register for a Governance SaaS

The client wanted to replace spreadsheet-based risk tracking with a live register that runs on its own review schedule and keeps a full history of every assessment. Rather than hire permanent specialist engineers, it chose Intelvision’s Talent as a Service model and added a dedicated team to its product group.

That let the client ship the risk module on its existing multi-tenant platform, reuse its roles and background jobs, and hold its own release cadence while the new module took shape.

Intelvision applied its Talent as a Service model. A dedicated team joined the client’s product team and worked inside its backlog, tools and release process. The team covered backend, frontend, QA, architecture and analysis, so the module moved from requirement to release without the client hiring permanent staff.

The team built on the existing platform rather than beside it. The risk module reuses the platform’s multi-tenant architecture, roles and background job platform, and it shares one data model with policies and controls.

The solution included:

• Dedicated Developers

  a dedicated team covering backend, frontend, QA, architecture and analysis, embedded in the client’s product group, following its conventions and release flow.

• Risk Register and Assessment Engine

  a live register with inherent, residual and target levels, scheduled four-step review cycles and a full history of every assessment.

• Visibility and Reporting

  a filterable heat map, alerts on rising scores, an Excel import wizard and PDF reports for audit.

• Embedded Specialist Team

  Intelvision placed engineers with governance-domain experience directly in the client’s product team, so the module was built by people who already understood regulated workflows.

  • Full coverage

    backend, frontend, QA, architecture and analysis roles working as one team.

  • Product-team fit

    the engineers followed the client’s own architecture, conventions and release flow instead of building alongside it.

  • Built-in quality

    the service runs automated tests and a SonarCloud gate, with changed code required to reach more than 80% coverage.

  • No hiring delay

    the team started contributing without a permanent recruitment cycle.

• A Register That Runs on Schedule

  Master risks generate a risk for each entity or entity group, and Hangfire schedules review cycles at any frequency from weekly to every three years. Every review is stored as its own cycle with inherent and residual scores, so the history is complete without anyone keeping notes. Alerts fire when a score worsens, and the Excel import wizard moves an existing spreadsheet register into the system with validation.

• One Connected Data Model

  Risks were modelled together with policies and controls on the platform’s shared multi-tenant data model, so a risk links to the controls that mitigate it. A history log written through the CQRS pipeline records every status change and action. Every record carries its tenant, which keeps customers’ data separate, and PDF reports give auditors the heat map, a single risk or its full history on demand.