Compliance Management Platform for Regulated Organisations

The compliance module was the most demanding of the three the client planned: frameworks authored once and copied into many tenants, controls generated per entity, assessments with evidence and approval, and a score that recalculates from citation to framework. The client needed engineers who could own that architecture end to end.

Through Intelvision’s Talent as a Service model it added a dedicated team to its product group and kept the module on the same release cadence as the rest of the platform.

Intelvision placed a dedicated team inside the client’s product group, covering backend, frontend, QA, architecture and business analysis. The team owned the compliance service from data model to Control Centre, following the client’s conventions and shipping through its pipeline.

Rather than a stand-alone tool, the module was built as one of three connected services on the platform’s shared multi-tenant data model, so compliance controls link directly to the risks they mitigate and the policies that evidence them.

The solution included:

• Dedicated Developers

  engineers with regulated-domain experience embedded for the length of the build, not a bench of interchangeable contractors.

• Framework and Control Engine

  frameworks with sections, principles and citations, master controls with classification, type and frequency, a control per entity, and five assessment task types with optional approval.

• Evidence and Live Scoring

  evidence with revision dates and expiry, a live score from citation to framework and per entity, and a Control Centre for bulk requests, reminders and export.

• Domain Expertise on Day One

  Intelvision selected engineers who had already built regulated workflows, so the client did not spend its first sprints teaching the team what a citation or a master control is.

  • Architecture ownership

    the team designed the framework hierarchy, shared content packs and the worker services for framework copy, control creation and evidence sync.

  • The client’s conventions

    Clean Architecture, DDD and CQRS as used across the platform, with Azure B2C authentication and the platform’s existing roles.

  • A separate service

    its own API and delivery pipeline, released in parallel with the risk and policy services.

  • Quality gate

    automated tests and SonarCloud, with changed code required to reach more than 80% coverage.

• From Framework to Living Controls

  A framework is authored once and copied into each tenant by a worker service. Each master control carries a classification, type and frequency and generates a control for every entity or entity group, so a new entity inherits its obligations automatically. Five assessment task types cover the different questions a control can ask, each with optional approval, and the Control Centre lets a compliance lead request assessments in bulk, chase them with custom reminders and export the result.

• Evidence That Cannot Go Stale

  Every piece of evidence has a revision date and an expiry. When it expires, a Hangfire job flips the control to non-compliant and tells its owner, so nothing lapses quietly between audits. A stored PostgreSQL function recalculates the score from each citation up to its framework and across entities, which keeps the number on screen current without a nightly batch or a manual roll-up before the auditor arrives.