The auditor wants to see our risk decisions.
Auditors want to know which risks you accepted, who approved them and until when. oolak keeps that register up to date as part of daily work, so audit season stops being a project.
What usually happens
- Risk decisions live in e-mails and meeting notes.
- Nobody remembers when an accepted risk was supposed to end.
- Evidence is collected by hand, weeks before the audit.
What changes
- Every accepted risk has an owner, a reason and an end date.
- Separation of duties is enforced, not just written down.
- Auditors find what they need without asking for spreadsheets.
How it works, step by step
Request an exception
A team explains why a finding can't be fixed now and proposes an end date.
Approve with a second person
Someone other than the requester reviews the impact and approves it.
Review when it expires
Expired acceptances come back for review automatically.
Hand over the evidence
Export the register, show compliance mappings and give the auditor a read-only account.
The features behind it
When something can't be fixed, decide it properly.
Some vulnerabilities can't be patched today.
Learn more Reporting and dashboardsShow progress with real numbers, not estimates.
Every scan cycle adds to a trend that management can trust.
Learn more Security and deploymentYour data never leaves your building.
oolak runs entirely on your own servers, including networks with no internet connection at all.
Learn more Verified closureOnly call it fixed when it is really fixed.
A finding can disappear from a scan because it was fixed, or simply because the server was switched off that day.
Learn moreSee oolak on your own data in 14 days.
We install oolak in your environment, connect your tools and show you your real risk picture. You keep everything it finds.
Technical details
Which frameworks are mapped?
How long is audit data kept?
More problems oolak solves
A critical vulnerability is in the news. Are we affected?
Find every affected system in minutes, scan just those systems and track the fix until it is confirmed.
See how it works Shadow ITWhich of our servers has everyone forgotten about?
Bring forgotten test servers, old subdomains and unmanaged hosts to light, and give each one an owner.
See how it works