Platform
What is compliance management software?
Compliance management software is a register of everything an institution is obliged to do by law, regulation or adopted framework, linked to the controls that satisfy each obligation, the evidence that the controls operate, the people responsible, and the dates by which things must be filed or attested. It answers the question a regulator or auditor actually asks: show me how you meet this requirement, and prove it.
ERMAML, the Ontech Risk & Compliance Suite, provides a compliance register mapped to Zambian regulators and to frameworks such as the FATF Recommendations, ISO 31000, ISO 27001, NIST CSF and COSO, with a control library, evidence vault, policy attestation, training records and a filing calendar with SLA alerts, developed by Ontech Solutions in Lusaka for regulated institutions in Zambia.
Key capabilities
Obligations register
Requirements from each regulator and adopted framework recorded with owner, frequency and status, and viewable by regulator, department or framework.
Framework mapping
Controls mapped to ISO 27001, NIST CSF, COSO, the FATF Recommendations and a Zambian obligations pack, so one control can evidence several requirements.
Control library and evidence vault
Each control holds its description, owner, test schedule and the versioned evidence that it operates.
Policy and attestation
Policies published to staff with attestation workflows by role, and conflict-of-interest and similar declarations captured on a cycle.
Training records
A learning module with mandatory courses by role, so training completion is evidence rather than a sign-in sheet.
Filing calendar
Every recurring filing and attestation on one calendar with SLA breach alerts and submission tracking.
Gap analysis
Coverage of each framework shown as met, partially met or open, with treatment cost tracked in kwacha.
How it works
- Applicable laws, regulator requirements and adopted frameworks are loaded into the obligations register.
- Each obligation is linked to one or more controls from the library, and owners are assigned.
- Evidence that controls operate is attached as it is produced, with versions retained.
- Policies are published and staff attest; mandatory training is assigned by role and tracked.
- The filing calendar drives recurring submissions and attestations with escalation on breach.
- Gap analysis and executive reports are produced from the register for the board and the regulator.
Benefits
Requirements and proof in one place
An examiner can be walked from an obligation to the control to the evidence without opening a shared drive.
One control, many frameworks
Mapping avoids maintaining the same control several times for different frameworks.
Attestations that are actually recorded
Policy acknowledgements and declarations are captured with dates and names.
Gaps visible before the audit
The register shows what is unmet while there is still time to fix it.
Who it is for
- Chief compliance officers and compliance managers.
- Internal audit teams testing controls and tracking findings.
- Company secretaries and governance functions managing policies and attestations.
- ICT security teams evidencing controls against ISO 27001 and NIST CSF.
Zambia-specific considerations
A regulated Zambian institution typically answers to a sector supervisor such as the Bank of Zambia, PIA, SEC or ZICTA, to the Financial Intelligence Centre for AML/CFT, to the Office of the Data Protection Commissioner under the Data Protection Act No. 3 of 2021, and to other bodies depending on its business. Keeping these obligations in one register, rather than one per department, is what makes the overall compliance position visible.
Many Zambian institutions also adopt international frameworks, ISO 27001 for information security or COSO for internal control, alongside local requirements. A register that maps one control to both a local obligation and an international framework halves the maintenance.
How ERMAML addresses this
A Zambian obligations pack
ERMAML ships with obligations and frameworks relevant to Zambian regulators and lets the institution add its own, viewable by regulator or department.
Compliance, risk and audit on one platform
Obligations link to controls in the same library the ERM module uses for RCSA, and findings from internal audit flow to actions with maker-checker closure.
Evidence that cannot quietly change
Policy changes, attestations and evidence versions are recorded on the hash-chained audit trail.
Frequently asked questions
What is compliance management software?
It is software that records an institution's regulatory and framework obligations, links each to the controls that meet it and the evidence that those controls work, assigns owners, and tracks filings, attestations and training. Its purpose is to show, at any time, how each requirement is met and to surface gaps before an examination.
How is it different from ERM software?
ERM software manages risks: what could go wrong, how likely it is and what mitigates it. Compliance management manages obligations: what the institution must do and the proof that it does. The two share controls, which is why ERMAML holds both in one platform with one control library.
Which frameworks can be mapped?
The control library maps to ISO 27001, NIST CSF, COSO, the FATF Recommendations and a Zambian obligations pack, and institutions can add frameworks of their own. A single control can evidence requirements in several frameworks.
Does it handle policy attestation and training?
Yes. Policies are published to staff with attestation workflows by role, declarations such as conflict-of-interest are captured on a cycle, and a learning module assigns mandatory courses by role and records completion.
Can it show our compliance gaps?
The gap-analysis view shows each framework's requirements as met, partially met or open, with the responsible owner and the treatment cost tracked in kwacha, so remediation can be prioritised before an audit.
Sources
See ERMAML on your own data
Request a demo with Ontech Solutions in Lusaka and see sanctions screening, KYC, transaction monitoring, goAML reporting and the risk register working together in one platform.
Last updated 2026-09-13. Published by Ontech Solutions, Lusaka, Zambia.