Solutions
Compliance & Regulated Operations — RAG on the corpus the audit hangs on.
Policies, controls, evidence, attestations. Every retrieval traceable. Every answer cited.
Policy and control Q&A, audit-evidence discovery, regulator-response drafting, and risk-knowledge research — running over the controls inventory, policy library, and attestation evidence your compliance and internal-audit teams already maintain.
The regime
Compliance and risk teams sit at the intersection of every regulated workflow in the organization. The corpus they operate on — policies, procedures, control narratives, audit findings, attestation evidence, vendor agreements, regulator correspondence, prior responses — is dense, frequently revised, and load-bearing for every Sarbanes-Oxley (SOX) attestation, every Payment Card Industry Data Security Standard (PCI DSS) assessment, every General Data Protection Regulation (GDPR) inquiry, and every regulator letter the company receives.
A Retrieval-Augmented Generation (RAG) system that handles this corpus has to satisfy the same chain-of-custody and audit standards the compliance function itself operates under. Citorum runs inside the organization's perimeter, indexes the corpus with chain-of-custody attached at ingestion, and produces answers with citations to the specific policy paragraph or control narrative that grounds each claim. Faithfulness labels make it explicit when the corpus did not support the answer — Verified answers carry the citation; Review Recommended answers route to a senior compliance officer; Do Not Rely answers are never surfaced as authoritative.
Workflows
Four workflows for compliance and risk teams
Discovery & Research
Audit-evidence discovery across the controls inventory, prior assessments, attestation packets, and regulator correspondence. Faceted filters on control family, framework, document date, and review status — citations to the document span the auditor actually clicks through to.
Compliance Q&A
Policy and control Q&A — "does this control cover that audit finding?" — framework-mapping lookups (National Institute of Standards and Technology (NIST) 800-53 against International Organization for Standardization (ISO) 27001 against Service Organization Control 2 (SOC 2)), and regulator-rule interpretation. Adjudication labels flag ambiguous answers for the Chief Compliance Officer before they enter a regulator response.
Drafting & Summarization
Audit-response drafts with citations to the policy paragraph that grounds each claim, regulator-letter drafts grounded in the control narrative, internal-attestation drafts that survive the external audit review. The reviewer sees what was cited and what was not, so the response is defensible the day it ships.
Knowledge Q&A
Institutional risk knowledge across the control framework, prior decisions, incident learnings, and vendor risk reviews. Faithfulness labels route uncertain answers to a senior risk reviewer rather than presenting them as authoritative.
What changes for compliance and risk operations
The platform is the same; the configuration is control-framework-shaped.
Connectors target the document systems compliance and audit teams actually run: Governance, Risk, and Compliance (GRC) tools (RSA Archer, ServiceNow GRC, MetricStream), SharePoint policy and control libraries, network drives holding attestation evidence and regulator correspondence, and the integrated audit working papers your internal-audit team maintains. Control-framework metadata rides with documents — Sarbanes-Oxley (SOX), Payment Card Industry Data Security Standard (PCI DSS), General Data Protection Regulation (GDPR), Health Insurance Portability and Accountability Act (HIPAA), International Organization for Standardization (ISO) 27001, Service Organization Control 2 (SOC 2), National Institute of Standards and Technology (NIST) 800-53 — so an audit-response drafter can scope retrieval to the framework the regulator is asking about.
Identity integrates with the organization's Identity Provider (IdP) so compliance officer, internal auditor, control owner, and General Counsel roles flow through unchanged. Reviewer queues route uncertain answers to the appropriate seniority: a Review Recommended answer on an external-audit response routes to the Chief Compliance Officer; a Do Not Rely answer is never surfaced as authoritative in the response packet. The audit log retains every retrieval, prompt, response, and faithfulness score with seven-year default retention — long enough to satisfy Sarbanes-Oxley (SOX) retention and most external-audit working-paper requirements, configurable for the longer holds some regulators impose.
Deployment is on-premises inside the company's data center, in a customer-owned Virtual Private Cloud (VPC) the IT department already operates, or as a Citorum-managed dedicated tenant. No documents, prompts, or model outputs cross the company's perimeter in the default configuration.
Run a pilot on one framework.
Most compliance teams start with one control framework — Sarbanes-Oxley (SOX), Payment Card Industry Data Security Standard (PCI DSS), or one of the privacy regimes — and one document source. We scope, deploy, and have the team running searches in weeks, not quarters.