Compliance Risk Management System

Project overview

Banks answer to regulators, and keeping track of every circular, the risks it creates and the controls in place is a job in itself. CRMS puts that work in one system.

Two institutions run it in production. At ZTBL, one of Pakistan's leading agricultural development banks, it handles regulatory compliance, risk assessment and incident reporting across the whole organisation. At NRSP it covers the regulatory inventory, risk monitoring and compliance reporting.

Key results

Workflow

We built CRMS on Node.js and Express with EJS templates, and it works with MySQL or Oracle through Knex.js. Sign-in runs on Passport.js, Socket.io pushes live updates, and PM2 keeps it running.

Every entry follows a maker and checker workflow, so no one approves their own work. Makers log regulations and their action items, assess inherent risk and control effectiveness, and the system works out residual risk and tracks gap treatment plans. Checkers review and approve. Incident reporting, key risk indicators, risk and control self-assessment and a full audit log complete it.