Platform
What is enterprise risk management software?
Enterprise risk management (ERM) software is a system that records an institution's risks, the controls that mitigate them, the assessments that test those controls, and the indicators and incidents that show whether risk is rising. It replaces the spreadsheets and Word documents most risk functions still use with one register that the board, the risk function, internal audit and the regulator can all read.
ERMAML, the Ontech Risk & Compliance Suite, is ERM software developed by Ontech Solutions in Lusaka. Its ERM module gives banks, microfinance institutions, insurers, pension funds, telecoms and public bodies in Zambia a risk register anchored to ISO 31000 and COSO, risk and control self-assessment (RCSA), key risk indicators (KRIs), incident and operational-loss registers, vendor risk, and executive dashboards, alongside the AML/CFT module in the same platform.
Key capabilities
Risk register
Risks captured against a taxonomy with likelihood and impact scoring, inherent and residual ratings, owners, and treatment plans with cost tracked in kwacha.
Controls and RCSA
A control library mapped to frameworks such as ISO 27001, NIST CSF and COSO, with periodic risk and control self-assessments and evidence attached to each control.
Key risk indicators
KRIs with thresholds, automatic breach detection and escalation to the accountable owner.
Incidents and operational losses
An incident register linked to the controls that failed, and an operational-loss register with category-level analytics.
Compliance obligations
Regulatory obligations and frameworks mapped to controls and evidence, with a filing calendar and SLA alerts.
Vendor and ICT risk
Third-party register with due diligence and contract repository, plus ICT asset, change and ticket records for technology risk.
Executive reporting
Heat maps, board packs and dashboards produced from the live register rather than assembled by hand each quarter.
How it works
- The risk taxonomy, scoring scales and control library are configured once for the institution.
- Risk owners record risks and link each to the controls that mitigate it and the KRIs that monitor it.
- RCSA cycles test controls on a schedule, with evidence and reviewer sign-off recorded in the system.
- Incidents and operational losses are logged as they happen and linked back to the controls involved.
- KRI breaches, overdue treatments and failed controls escalate automatically to the accountable person.
- The board, internal audit and the regulator read reports produced from the same live register.
Benefits
One register instead of many spreadsheets
Risk, compliance, audit and ICT work from the same record, so the heat map the board sees matches what the risk owners maintain.
Evidence attached, not filed elsewhere
Control evidence, assessments and sign-offs live on the control, which shortens audit preparation.
Earlier warning
KRIs and incident links surface rising risk before the quarterly review.
Traceable decisions
Every change to a risk, control or treatment is logged with who made it and when.
Who it is for
- Chief risk officers and risk managers replacing spreadsheet registers.
- Compliance functions that need obligations, controls and evidence in one place.
- Internal audit teams tracking findings to closure with maker-checker review.
- Boards and audit committees that want a live view rather than a quarterly pack.
Zambia-specific considerations
Regulated institutions in Zambia answer to sector regulators such as the Bank of Zambia, the Pensions and Insurance Authority, the Securities and Exchange Commission and ZICTA, each with its own returns, and to cross-cutting laws such as the Data Protection Act No. 3 of 2021. An ERM register that maps obligations to controls and evidence makes it easier to show a regulator how each requirement is met.
Most Zambian institutions are small enough that the risk, compliance and audit functions overlap. A single platform with role-based access avoids buying separate tools for each function and keeps the audit trail in one place.
How ERMAML addresses this
ERM and AML in one platform
Sanctions, PEP and transaction-monitoring events from the AML module can raise incidents in the ERM register, so financial-crime risk is managed alongside operational and compliance risk.
Built around Zambian obligations
The compliance register ships with obligations and frameworks relevant to Zambian regulators and a filing calendar for their returns.
Tamper-evident audit trail
Case events, screening results and policy changes are hash-chained, so an auditor can verify the record has not been altered.
Frequently asked questions
What is enterprise risk management software?
Software that records an institution's risks, controls, assessments, key risk indicators and incidents in one register, so risk can be scored, monitored and reported consistently across the organisation instead of in separate spreadsheets.
What is the difference between ERM software and a GRC platform?
GRC (governance, risk and compliance) is a broader label that adds compliance obligations, policies and audit management to risk management. ERMAML covers both: its ERM module holds the risk register, RCSA and KRIs, and its compliance register maps obligations and frameworks to controls and evidence.
Does ERMAML follow ISO 31000 or COSO?
The risk register and scoring model are anchored to ISO 31000 and the COSO ERM framework, and the control library can be mapped to ISO 27001, NIST CSF and COSO. Institutions configure their own taxonomy and scales.
Can it handle RCSA and KRIs?
Yes. RCSA cycles are scheduled with evidence and reviewer sign-off, and KRIs carry thresholds that trigger automatic escalation when breached.
Can ERM software be used by a small microfinance institution?
Yes. Branch-scoped role-based access lets a single MFI or a multi-branch network use the same register, and the AML module in the same platform covers KYC, screening and FIC reporting without a second system.
Sources
See ERMAML on your own data
Request a demo with Ontech Solutions in Lusaka and see sanctions screening, KYC, transaction monitoring, goAML reporting and the risk register working together in one platform.
Last updated 2026-09-13. Published by Ontech Solutions, Lusaka, Zambia.