Four kinds of institution, one register that understands each of them.
A commercial bank, a microfinance house, a payment provider and an advisory firm are doing the same work under the same standard, with very different registers. Zikomo is configured, not translated.
The people who sign, by institution.
Tier 1 and tier 2
Core banking, ATM, POS, agency banking, SWIFT.
The asset register is long, the owners sit in different divisions, and the regulator expects a documented annual cycle with residual risk formally accepted. Zikomo models each of those as a first-class thing: assets carry value in the bank's own currency, owners are people with logins, and the cycle locks when the CRO signs.
Typical register: 40 to 200 risks across application, infrastructure, people, information, process and compliance.
and SACCOs
Leaner teams, and usually a first certification.
One person often holds IT, operations and compliance at once. The questionnaire matters most here, because it drafts a register from an Annex A walkthrough rather than expecting a risk taxonomy to already exist.
Starting point: the 93-control questionnaire, answered once, producing a scored draft register for review.
and fintech
A card data environment changes the shape of the register.
Scope is narrower and deeper. The cardholder data environment, the switch, the settlement path and the third parties around them carry most of the exposure, and the annualised loss figures are the ones the board reads first.
Risks attach to assets, to processes, or to third parties, so vendor exposure sits in the same register rather than a parallel spreadsheet.
and vCISOs
A portfolio of client organisations, from one console.
Consultants work across every client. Client staff see only their own institution. The control library is shared once and pushed down, rather than rebuilt per engagement.
None of the enterprise GRC platforms is built for this. They assume one enterprise with subsidiaries, not a firm with a book of unrelated clients.
By configuration
Built for African institutions by configuration, not by translation.
Your currency, not a converted one
Asset value bands are configured per institution in that institution's own currency. A bank valuing in kwacha and one valuing in naira need entirely different scales, and neither figure should be converted for display in a board pack.
Your regulator's calendar, not a hard-coded one
Obligations are configured per institution: the name, the authority, the recurrence, the owner and the reminder lead time. The same engine serves Lagos, Lilongwe, Nairobi and Accra without a line of code changing.
Four things
Four things to have ready, and one of them is time.
A list of what you are protecting
An asset inventory, even a rough one. The assessment hangs off it, and a register with no assets behind it cannot carry a monetary figure.
Importable from a spreadsheetA person against every domain
Named risk owners. Not a department, not a mailbox. Clause 6.1.2 asks for people and the platform will not accept a placeholder.
They receive loginsA threshold your board has approved
Risk appetite, written down and signed. Without it, evaluation has nothing to compare against and acceptance means nothing.
Configured at onboardingRealistic elapsed time for a first cycle
About four weeks from onboarding to a signed first register, most of which is your people answering questions rather than software being configured.
Target: under 4 weeksyou are
Tell us what kind of institution you are.
We will show you the register shaped for it, using your own assessment if you have one.