What is Risk Core

Risk Core is one platform with two modules — ERM Core and BCP Core. It runs the whole risk life cycle, from the risk register to the employee’s phone, for Thai corporate groups and the companies inside them.

Risk Core is co-developed by Qirin X and ComplyWise, and both companies offer it. This documentation serves the customers of both.

One sign-in page, data separated per company, two modules on one core. Companies in a group are linked only by report-up.

One platform, two modules

Level	Name	Contents
Platform	Risk Core	The whole product: the shared core and two modules
Module	ERM Core	RCSA · Loss Event · KRI · BIA · Dashboards and group roll-up
Module	BCP Core	Hazard watch and early warning · BCP level and command · Check-in and status map · Routes · Call tree and group chat · Exercise log · Public CSR path
Shared	Core	Organisation structure · staff register · one identity · roles and the roles panel · action register · audit log

ERM Core is built for the risk desk and the boardroom pack. BCP Core lives on every employee’s phone. A company can use ERM Core, BCP Core, or both on the same core.

Your domain, your data

Your company’s own address. Staff go to their company’s address, sign in on the Risk Core sign-in page and land in their own company’s data. See Signing in.
Each company’s data kept separate. Row-level security in the database keeps a company’s records apart from every other company’s, including its sister companies in the same group. A separate database per company on request.
Group companies are linked by report-up. Each subsidiary sends upward what it has validated or approved. The parent reads and consolidates it, cannot change it, and has no access to the subsidiary’s records. Sister companies never see each other. See Product rules.

One account, one audit log

One account, both modules. A person who is both CFO and BCP head signs in once and sees both roles. A person who holds roles in several companies of the group switches company from the header. See Your roles and where to start.
The organisation structure is entered once and used by both modules.
One audit log and one action register hold every act in either module.

The modules feed each other

An incident in BCP Core becomes a loss event in ERM Core without re-keying.
A risk assessed in RCSA can be the hazard BCP Core watches.
The BIA in ERM Core tells BCP Core which activities are critical, how fast each must recover and how many people it needs.

Built to serve COSO ERM and ISO 22301

Risk Core is built to serve COSO ERM (2017) for enterprise risk and ISO 22301:2019 for business continuity, and its loss events follow the Basel Level-1 event types. It is designed for companies supervised by the SEC, BOT and OIC. The clause-by-clause map is in Standards mapping.