Standards coverage
Built on the standards
Built on the standards
your auditors already use.
ClariAze is designed around international standards for risk, anti-bribery, whistleblowing and compliance management — so the evidence you produce in daily work is the evidence an auditor asks for.
ClariAze supports the practices these standards describe. Certification and legal compliance depend on your organisation's own management system, policies and decisions; ClariAze is not a certification body and does not provide legal advice.
ISO 31000
Risk management — Guidelines
The international reference for how organisations identify, analyse, evaluate, treat and monitor risk.
| What the standard expects | How ClariAze supports it |
|---|---|
| Risk identification | AI risk analysis from a situation description, a chosen risk type or uploaded documents; a shared 15-category taxonomy. |
| Risk analysis & evaluation | Likelihood (1–5) × impact (1–5) on a 5×5 matrix; levels Low, Medium, High, Critical computed consistently; inherent and residual levels. |
| Risk treatment | Responsible person, priority, deadline, action plan; actions with owners, progress and resolution notes; evidence files. |
| Monitoring & review | Periodic review reminders (weekly to annually) for each owner; overdue flags; status from New to Completed with a resolution note. |
| Recording & reporting | Permanent risk numbers, notes and files; immutable audit trail; Command Center and annual compliance report. |
| Communication & consultation | In-app notifications to owners; AI proposals decided by the compliance officer with a recorded reason. |
ISO 37001
Anti-bribery management systems
Requirements and guidance for preventing, detecting and responding to bribery.
| What the standard expects | How ClariAze supports it |
|---|---|
| Anti-bribery policy | Anti-bribery and related policies in the built-in policy library; attestation campaigns record who has read them. |
| Awareness & training | Training assignments to every active employee with completion tracking; readiness shown on the Command Center. |
| Due diligence | Third-party register with due-diligence reviews, risk ratings, a sanctions/PEP screening flag and automatic review cycles. |
| Gifts, hospitality, donations & similar benefits | Gift register (given, received, declined) with values, public-official flags, company limits and independent review; pre-approvals. |
| Controls | Control library with owners, test frequency, results (effective, partially effective, ineffective) and remediation. |
| Raising concerns | Confidential, anonymous-capable reporting channel open to anyone, with a private tracking key. |
| Investigating & dealing with bribery | Investigation cases with severity, assignee, notes, corrective actions and documented outcomes. |
| Conflicts of interest | Conflict-of-interest and outside-interest registers with annual declaration campaigns. |
ISO 37002
Whistleblowing management systems
Guidelines for establishing and operating an effective whistleblowing system based on trust, impartiality and protection.
| What the standard expects | How ClariAze supports it |
|---|---|
| Receiving reports | Public reporting form, no account needed, available from every page and from the sign-in page. |
| Protection of the whistleblower | Anonymous reports store no name, contact details or network address; the audit trail never names the reporter; reporting pages send no referrer. |
| Assessing reports | Confidential inbox visible only to the company's compliance team and platform administrators; status tracking. |
| Addressing reports | One click opens an investigation case linked to the report; notes, corrective actions and a closing outcome. |
| Concluding & feedback | Reference number and private tracking key let the reporter see status and the date of the last change. |
ISO 37301
Compliance management systems
Requirements for establishing, developing, implementing, evaluating, maintaining and improving a compliance management system.
| What the standard expects | How ClariAze supports it |
|---|---|
| Compliance obligations | Compliance calendar of regulatory and contractual obligations with owners, frequency and due dates that roll forward. |
| Compliance risk assessment | Compliance & Legal risk type, AI analyses and the risk register. |
| Documented information | Policy library, document storage by company, reference numbers on every record. |
| Competence & awareness | Trainings and policy attestations with named evidence. |
| Operational controls | Declarations, pre-approvals, third-party reviews and control testing. |
| Raising concerns & investigation | Speak-up channel and investigation cases. |
| Monitoring & reporting | Command Center, annual compliance report and immutable audit trail. |
COSO ERM
Enterprise Risk Management — Integrating with Strategy and Performance
A framework that connects risk management with strategy-setting and performance.
| What the standard expects | How ClariAze supports it |
|---|---|
| Governance & culture | Roles and access, policy attestations, code of conduct, speak-up channel. |
| Strategy & objective-setting | Risk appetite and objectives captured in each AI analysis. |
| Performance | Identification, severity assessment, prioritisation and responses in the risk register. |
| Review & revision | Review reminders, control testing results and re-running analyses as things change. |
| Information, communication & reporting | Notifications, Command Center, compliance report and audit trail. |
GDPR
EU General Data Protection Regulation
The reference law for handling personal data, with hard deadlines for breaches and individuals' requests.
| What the standard expects | How ClariAze supports it |
|---|---|
| Personal data breaches (Art. 33–34) | Breach register with what happened, when, severity, affected records, containment status and regulator notification. |
| Rights of the data subject (Art. 15–21) | Subject-request register for access, erasure, rectification, portability and objection. |
| Time limits (Art. 12) | A 30-day due date set automatically on every request, with overdue highlighting. |
| Data protection impact assessment (Art. 35) | DPIA records: processing, risks, mitigations, draft and approval. |
Directive (EU) 2019/1937
Protection of persons who report breaches of Union law
The EU Whistleblowing Directive sets expectations for internal reporting channels and the protection of reporting persons.
| What the standard expects | How ClariAze supports it |
|---|---|
| Secure, confidential internal channel | Dedicated reporting portal; reports readable only by the company's compliance team and administrators. |
| Confidentiality of the reporter's identity | Anonymous option storing no identity or network address; identified reports visible only to authorised reviewers. |
| Diligent follow-up | Status workflow, investigation cases and corrective actions. |
| Feedback to the reporting person | Tracking page showing status and the date of the last status change. |
Preparing for an audit?
Show evidence, not effort.
We'll walk through how ClariAze records the evidence for the standards you work with.