How It Works
From four inputs to a structured regulatory risk profile
A repeatable, structured process. At each step you can see exactly what you provide, what RuleboardAI performs, and what artifact comes out.
What you give, what you get — at every step
Read each column top to bottom: your input, the engine's action, the artifact produced.
Step 01
Classify
Company name, URL, public/private, ticker
RCPS classifies the client on listing status, size, industry, geography, data intensity, ownership, and growth stage.
A classified client profile. Scope is set by the classification, not by guesswork.
Step 02
Scope
The classified profile from step 01
From the pre-built workflow library covering the relevant GRC domains, the engine marks each workflow in scope, conditional, or out of scope.
A scoped workflow set: each workflow marked in scope, conditional, or out, with the reason recorded.
Step 03
Execute & Score
Public-source data, then your evidence on verification
Workflows run in the right mode. Each finding is labeled Confirmed, Likely, Conditional, or Escalate.
Scored findings, each with an evidence status and a cited source.
Step 04
Deliver & Repeat
Nothing — outputs assemble from the run
A named person reviews the report before delivery. Every finding carries its source and a remediation path. You decide when to run the next one.
A report structured for internal review and evidence verification, with the open questions your team still needs to close.
Step 01 — RCPS Classification
The classification decides the scope
Before any workflow runs, the RCPS model reads the client on each classification axis. Those answers decide which obligations apply — so scope is defined by methodology, not guesswork.
The example beside is drawn from our public Sample Profile.
- 1 · Listing status
- Publicly listed
- 2 · Company size
- Large enterprise
- 3 · Industry
- Fintech + national bank
- 4 · Geography
- US-primary
- 5 · Data intensity
- Maximum
- 6 · Ownership
- Public parent
- 7 · Growth stage
- Scale-up
Step 02 — Workflow Scoping
Applicable regulatory workflows, sorted for this client
Workflow scoping
Every client is assessed against the same set of applicable regulatory workflows across the relevant GRC domains. Each workflow is sorted into one of three buckets, and the determination is recorded so you can see why a workflow was included or left out.
- In scope
Applies to this client — runs this cycle.
- Conditional
Applies only if a trigger is met — flagged for review.
- Out of scope
Not applicable to this client — documented, not ignored.
Illustrative — the actual scope is determined per client during RCPS classification.
Step 03 — Run Modes
Each workflow runs in the mode that fits
The same workflow behaves differently depending on where the client already stands.
Build
Input
A control area that barely exists yet
Output
The report sets out the policy, evidence structure, and workflow the area needs
Gap
Input
An existing program + a target framework
Output
A ranked list of what is missing based on public sources only. No client documentation is reviewed for the preliminary profile.
Maintenance
Input
An already-built program on a schedule
Output
The report identifies the evidence refresh, control re-testing, and remediation tracking the program needs
Framework Mapping
Input
Multiple overlapping frameworks
Output
One evidence set mapped to the requirements it can satisfy at once
Mode summaries are plain-language descriptions of RuleboardAI's run modes. The preliminary profile runs in Gap Mode from public sources; the other modes describe how a workflow is assessed once client evidence enters under a Verified Assessment.
Step 04 — The Deliverable
Every finding carries its evidence
A finding is only useful if you can defend it. Each one ships with a severity, an evidence status, the obligation it touches, a cited source, and a recommended action.
See the full Sample ProfileCFPB Supervision — Commenced January 1, 2024
- Evidence status
- Confirmed (public record)
- Affected obligation
- Financial Regulation — ongoing consumer-compliance supervision readiness
Recommended action
Maintain evidence for consumer-compliance obligations, structured for internal review, under direct CFPB oversight.
…and every finding lands inside a report structured for internal review and evidence verification — an executive summary, the RCPS scorecard, and a cited source appendix.
CompanyScope — Regulatory Risk Profile
SoFi Technologies, Inc.
NASDAQ: SOFI · September 26, 2026
Executive summary
Overall control maturity is Defined (2.8 of 5). The high-severity findings concentrate around bank-charter heightened standards, KYC/CIP, and crypto exposure.
Composite maturity
2.8 / 5.0
Defined
Illustrative target — not a promised outcome
3.9 / 5.0
What this number means
Each GRC category is scored from 1 to 5: Initial, Developing, Defined, Managed, Optimized. The composite is the average of the category scores, shown to one decimal.
The word beside it is the nearest whole level. A score of 2.8 is closest to 3, so it reads Defined.
Scores come from public sources only. A low score usually means the evidence is not visible from outside, not that a control is absent.
The target is the average of what each category could realistically reach for an institution of this size and stage. It is not a promise and not a benchmark. Full rule in the methodology.
Scored categories
- Internal Governance
- ESG & Non-Financial Reporting
- Operational Risk
- Third-Party / Supply Chain Risk
- Cybersecurity
- SOC 2 (Trust Services)
- Financial Regulation
- International Frameworks
- Privacy & Data Protection
- Ongoing / Scheduled
- HR & People Risk
Finding excerpt · prioritized findings based on available public evidence
CFPB Supervision — Commenced January 1, 2024
See the lifecycle end to end
This process is stages 01–03 of the RuleboardAI lifecycle — assess, verify, report.
Scope of service
- RuleboardAI does not provide legal advice.
- RuleboardAI does not issue audit opinions, examination results, or attestations.
- Preliminary reviews use public sources only.
- Final reports require authorization, evidence intake, and verification.
Customers remain responsible for their own regulatory obligations.