Case Study · Financial Services
A governance, risk and compliance platform built end to end
A global professional services network in audit, tax, accounting and advisory needed one platform to help organisations run enterprise risk, audits, compliance and business continuity. AMT owned the whole product lifecycle, from requirements and architecture to deployment and ongoing maintenance.
Schedule Technical DiscoveryYour first conversation will be with a senior technical partner, not a salesperson.
Published
At a glance
- Client
- Global professional services network providing audit, tax, accounting and business advisory services
- Industry
- Financial services and professional services
- What AMT built
- Configurable, multi-organisation GRC platform
- Modules
- Enterprise risk management, risk tracker and audit management, business continuity, compliance, GDPR, SOC reporting, AML/CFT, dashboards and board reporting
- AMT's role
- Full lifecycle: discovery, design, architecture, full-stack engineering, QA, deployment, maintenance
- Stack
- Angular, Node.js, Express.js, Microsoft SQL Server
The short version
Organisations were juggling risks, audits, incidents, compliance duties and corrective actions across departments, often by hand. AMT built a single GRC application where each organisation configures its own structure, risk matrices, controls and regulatory modules. Risk scores recalculate when a control fails, audit findings link back to the risks they affect, and the board gets dashboards instead of spreadsheets.
The problem
- Fragmented governance. Risks, audits, incidents, compliance obligations and corrective actions sat in different departments.
- Different rules everywhere. Each organisation had its own frameworks, risk methods and reporting needs.
- Manual assessments. Risk evaluations, control testing and corrective action tracking needed heavy coordination.
- Little board visibility. Executives needed one view of risk exposure, control effectiveness and compliance status.
- Accountability. Risk owners, control owners, auditors and management needed clear responsibilities and traceable approvals.
- Flexibility. Many organisations had to run on the platform with independently configured structures, matrices, controls and roles.
What AMT built
Enterprise risk management
- Central risk and control libraries
- Bowtie risk analysis linking risk drivers, consequences, and preventive and reactive controls
- Inherent and residual risk assessments with configurable scoring matrices
- Risk scores that recalculate automatically when control assessments fail
- Treatment plans, scheduled reviews and monitoring
- Risk heat maps, trend analysis and executive dashboards
Risk tracker and audit management
- Internal and external audit observations
- Incidents, customer complaints and compliance non-conformities
- Remedial action assignment, validation and deadline tracking
- Automated notifications, follow-ups and escalations
- Evidence attachments, status history and audit trails
- Links from incidents and audit findings to the enterprise risks and controls they affect
Business continuity management
- Business continuity policy and programme management
- Central continuity plans and documentation
- Scheduling and running continuity tests
- Recording results and recovery actions
- Corrective action tracking
Regulatory compliance modules
| Module | What it covers |
|---|---|
| Compliance management | Compliance libraries, control monitoring, document repositories, governance frameworks, assessments |
| GDPR | Privacy policy management, incidents, remedial actions, risk treatment |
| SOC reporting | Control assessments, test scripts, audit evidence, reporting |
| AML/CFT | KYC workflows, customer risk assessments, policies, training, suspicious transaction reporting |
Dashboards and board reporting
- Interactive risk heat maps and evaluation dashboards
- Control assessment status and failure analysis
- Department-level risk and compliance reports
- Board-level reports with configurable tables and charts
- Export to PDF, Excel and other formats
Multi-organisation configuration and workflow automation
- Organisation-specific risk matrices, libraries and regulatory modules
- Role-based access for administrators, risk moderators, risk owners, control owners and action owners
- Automated assessments, scheduled reviews and reminders
- Configurable approval and validation workflows
- Links between risks, controls, incidents, audit observations and corrective actions
How AMT owned the product
| Stage | What AMT did |
|---|---|
| Discovery and design | Requirements, process mapping, functional specifications, user journeys |
| Architecture | Enterprise architecture, database design, modular system design, business-rule modelling |
| Engineering | Angular, Node.js, Express.js and Microsoft SQL Server |
| Business logic | Risk scoring, assessment scheduling, approvals, notifications, cross-module links |
| Quality | Functional, integration and regression testing of governance workflows |
| Release | Configuration, production deployment, release management |
| After launch | Maintenance, bug fixes, enhancements, technical support |
Results
- One platform for enterprise risk, audits, compliance, business continuity and regulatory workflows
- Risk assessments, control testing, corrective actions and approvals digitised and automated
- Management sees risk exposure, control effectiveness and remediation progress in dashboards
- Organisations configure their own structures, frameworks and permissions
- Clear ownership, approval history and audit trails
- Configurable board reporting
- AMT continues to maintain and develop the platform
Technology stack
| Layer | Technology |
|---|---|
| Front end | Angular |
| Back end | Node.js, Express.js |
| Database | Microsoft SQL Server |
| Architecture | Modular, multi-organisation enterprise web application |
| Core capabilities | Workflow automation, role-based access, reporting, risk analytics |
Before you build something similar
- Build or buy? Off-the-shelf GRC tools are fine if your frameworks are standard. Build when your risk methods, matrices or regulatory modules are specific to you or your clients.
- Which link matters most? The value is in connecting a failed control to the risk score and the audit finding. Map those relationships before you design screens.
- Who configures it? If many organisations use it, they need to set their own matrices and roles without a developer.
- What does the board actually read? Design the board report early. It drives what data you must capture.
FAQ
What does a GRC platform do?
It brings governance, risk management and compliance into one system: risk registers and assessments, audit findings, incidents, policies, regulatory modules and reporting, with owners and approvals for each.
What is bowtie risk analysis?
A method that maps a risk's causes on one side and its consequences on the other, with preventive controls before the event and reactive controls after it. This platform supports it inside the risk module.
Can one GRC platform support GDPR, SOC and AML/CFT?
Yes. This platform has dedicated modules for each, alongside general compliance management.
Which tech stack did AMT use?
Angular, Node.js and Express.js, with Microsoft SQL Server as the database.