AI for operational and enterprise risk
Ultramarine Work reads the files your risk program keeps, pre-populates RCSAs, maps loss events to Basel event types, reviews vendor SOC reports and builds BIAs. The output cites the file behind each number and statement.
Q3-2026-op-risk-report.pptxExampleAsk it for
“Prefill the Q3 RCSA for corporate payments from this year’s loss events, audit findings and KRI breaches, and flag any rating the evidence does not support.”
RCSA-corporate-payments-Q3.xlsx“Review Coreline Payroll’s SOC 1 Type II for the period ended December 31, 2025. List every exception, every carve-out and the CUECs we own.”
Coreline-SOC1-review-2025.docx“Draft the loss event writeup for the $184,000 duplicate payment loss under execution, delivery and process management, with root cause and failed controls.”
Loss-writeup-EDPM-25-0617.docx“Rebuild the funds transfer BIA with impact by hour of downtime, MTD, RTO and RPO per function, and mark every RTO that depends on a slower upstream recovery.”
BIA-funds-transfer.xlsx“Compare the 2026 cyber and crime policies to the exposures sheet and list every sublimit, exclusion and missing grant that leaves the program short.”
Program-gap-review-2026.xlsx“Write the test plan for wire transfer dual approval, draw a sample of 40 wires from the March wire log and document the sample selection and attributes.”
Wire-approval-testing-plan.xlsx
How it works
- 1
Put the risk program’s files in the folder
The folder should hold the RCSA workbook and taxonomy, the loss log and KRI breaches exported from the GRC tool, control-test results, policies, the last BIA and the SOC reports your vendors sent.
- 2
Tell it what you need
The prefilled RCSA, the SOC review memo, the BIA workbook or the test workpaper comes back in your team’s format, with live formulas and the source file named for every rating.
- 3
Challenge it the way second line would
Each rating arrives with the evidence behind it and a list of what it could not reconcile, so the review is about challenging ratings rather than rebuilding schedules. What goes to committee is still your call.
Inside the Operational & Enterprise Risk mode
Enterprise and operational risk assessment
Populates RCSAs from loss events, audit findings and KRI breaches, classifies losses under Basel event types, and drafts appetite tables and ORSA sections.
Vendor risk and SOC report review
It reads a vendor’s SOC 1 or SOC 2 report the way a reviewer does, down to each exception, carve-out and CUEC, and a clean opinion does not mean a clean vendor.
Business continuity and disaster recovery
Builds the BIA with MTD, RTO and RPO per function. It catches a 4-hour RTO on a 12-hour upstream recovery and drafts the continuity and COOP plans.
Insurance coverage analysis
From a claim to a whole program, it maps grants, exclusions, conditions, limits and sublimits, then drafts the coverage position, tender response or gap list.
Compliance monitoring and testing
Writes the test plan and documents sample selection and attributes. Workpapers trace each exception to its file, and it drafts the retest workpapers.
- Office skills
- Excel, Word, PowerPoint, PDF
- Tools
- Read, edit and write files, Search files, Run code, Search and read the web, View images
- Connectors
- SharePoint, Google Drive, Gmail, and additional custom connectors
- House style
- Your fonts, layouts and rules, on every file
Who it’s for
Operational, third-party and enterprise risk staff and business continuity planners in companies, banks, insurers and agencies, from analysts to heads of risk.
Questions
Can it review a vendor’s SOC report?
Yes, it reads the vendor’s report and drafts the review. It pulls the opinion, review period, exception rows, subservice organizations and CUECs, and it measures how far a bridge letter falls short of your reliance date. Anything the report does not cover goes into the review memo, such as criteria nobody scoped or a carve-out subservice organization with no report of its own. The reliance decision sits with the reviewer, not the report.
Is it safe to load loss data and vendor SOC reports into it?
Ultramarine Work changes files only in the project’s folder. When a request needs it, it can read files elsewhere on your computer, never passwords, keys or app data, and you can turn that off in settings. The model runs on Paper Instruments’ servers, so the content it works on is sent there to be processed. Paper Instruments is SOC 2 Type II, and our security and compliance details are on our compliance page. Whether that material may go to an external tool is a decision for your legal and compliance teams.
Will examiners and internal audit accept AI-drafted workpapers?
Your organization’s governance and compliance teams decide that, and no tool can promise what an examiner will conclude. What examiners and auditors ask about AI use is what controls covered the input and who reviewed the output, so the review itself becomes your evidence. Numbers and statements trace to the files they came from, anything it could not reconcile is written up as a gap, and a person reviews every file before it leaves the folder.
Will it just rate every control effective?
No, it drafts a proposed rating and the evidence behind it, and it marks the ratings that the loss data, audit findings or KRI breaches do not back up. The challenge, the re-rating and the unit head sign-off stay with the process owner and your team. A control rated Effective the same quarter an audit finding landed on it is exactly the mismatch it should surface.
How does it avoid boilerplate about risks we do not actually have?
It works from the files in the project’s folder, not from a general idea of what risks a company like yours ought to have. Put last cycle’s RCSA, the risk taxonomy, the loss log and the BIA in the folder, and it drafts against those, matching the workbook’s layout and conventions. Where it cannot ground a statement in one of your files, it notes the gap instead of inventing a plausible-sounding rationale.