For consulting and audit firms
Deliver every NCA, PDPL and NDMO engagement on one platform.
A read-only Audit Room for your assessors, control tests on reproducible samples, the NCA workbook exported, and CIYAJ deployed for each client under your look and name.
For assessors
One place for the assessor to see everything.
The Audit Room shows a cycle as it stands, domain by domain and control by control, read-only. Internal assessors and external auditors work from the same record the organization works in.
01Everything for each controlThe rating, coverage, the assessor's story and conclusion, the approval trail, evidence, exceptions and tests.
02Read-only by designAssessors see, they cannot change. Files above their classification ceiling are listed but cannot be opened.
03Only what they may seeEach person sees only the frameworks the access matrix allows.
04External access that endsThe External Auditor role carries an end date. After it, the role gives nothing.
05Samples you can reproduceDraw a test sample, or test design and operating effectiveness on samples a reviewer can draw again.
06The NCA workbook, exportedSave the NCA workbook for the chosen cycle and framework.
For consulting and audit firms
Built for the firms that deliver Saudi compliance.
Run every NCA, PDPL and NDMO engagement on the same library, the same evidence trail and the same Audit Room, deployed the way each client needs it.
- An Audit Room for your teamA read-only view of the client's cycle, with external access that ends on the date you set.
- Tests you can defendDesign and operating-effectiveness tests on reproducible samples. A failed test raises a corrective action.
- The NCA workbookExport the results in the NCA workbook for the chosen cycle and framework.
- A library ready on day one37 frameworks, 1,300+ requirements, links between frameworks and suggested common controls.
- Your look and nameLook-and-feel presets, including a neutral one. Set the app name, logo and colours at each client.
- From project to programmeAttestation campaigns and evidence renewals keep clients current between assessments.
Illustrative data
How it works
From the regulator's text to a verified result.
- 01NCA · SDAIA · NDMORegulators
- 0237 frameworksWith their official text
- 031,300+ requirementsLinked across frameworks
- 04Your controlsCommon controls answer many
- 05Owners and coverageEach part of the organization
- 06EvidenceRead on upload, renewed on time
- 07Review chainOwner to Compliance
- 08ResultsGrades and three measures
Every gapCorrective actions with owners and dates, or an exception with an expiry
A cycle, step by step
- 01ScopeCIYAJ works out which frameworks and requirements apply to each part of your organization, and the cycle owner confirms the coverage.
- 02PrepareOwners rate each control, record its coverage and attach the deliverables that prove it.
- 03ReviewThe line manager and the second line approve or return. The Compliance team reads the assessor's story and writes a conclusion.
- 04MeasureGrades and the three measures update as controls are validated, with the history of every cycle.
- 05Keep it currentCorrective actions are closed and verified, evidence is renewed and owners confirm controls between cycles.
See CIYAJ against your own frameworks.
Tell us which frameworks are in scope and we will arrange a walkthrough with your team.