Everything a community institution needs to run compliance — and prove it.

Policy Library

One authoritative version of every policy and procedure.

Upload a policy once and GCO handles the rest — version history, owner assignment, review cadence, and board-approval sign-off. Uploaded PDFs are read by AI, mapped to the regulations they satisfy, and made searchable so staff can ask a plain-English question and get an answer cited from the current approved version.

• Version control with full change history and prior-version retrieval
• Owner, reviewer, and next-review date on every document
• AI mapping of uploaded policies to the regulations they address
• Natural-language search across the most recent approved versions
• Automatic review reminders before a policy goes stale

Employee Training

Assign, prove, and report completion without spreadsheets.

Build role-based curricula from your own policies or from packaged content, then assign by role, department, or individual. Quizzes score automatically, attestations are timestamped, and external training completed outside the platform can be recorded so a single roster reflects every hour earned.

• Role- and audience-based assignment with due dates
• Quiz scoring, attestation capture, and completion certificates
• External / third-party training recorded against the same employee record
• Escalating reminders for overdue assignments
• Exam-ready completion roster by employee, module, and date

Controls & Evidence

Recurring work that proves itself.

Define recurring control tasks with owners, frequencies, and evidence requirements. Every submission lands in a traceable evidence library that links back to the control, the policy it supports, and the risk it mitigates — so an examiner request is a lookup, not a scramble.

• Recurring schedules with owner assignment and overdue escalation
• Evidence library linked to controls, policies, and risks
• Immutable link events showing who attached what, and when
• Completion history retained across periods

Comment & Complaint Log

Consumer complaints handled to a documented close.

Structured intake with regulator-aligned categories, routing to an owner, and a lifecycle that cannot be closed until resolution details and a resolution date are recorded. Every entry is exportable with its full narrative for the exam file.

• Regulation-aligned categories and channel tracking
• Mandatory resolution details and resolution date before close
• Aging and response-time visibility
• Full detail export into board and exam reporting

Risk & Assessment

Weighted risk scoring your board can follow.

Institution-wide risk evaluations with weighted inherent and residual scoring, mitigating controls attached as evidence, and trend history that shows movement between assessment cycles rather than a single point in time.

• Inherent vs. residual scoring with configurable weighting
• Mitigating controls and evidence attached to each risk
• Period-over-period trend history
• Board-ready summaries generated from live data

Audit Program

Engagements, findings, and remediation in one thread.

Plan and schedule internal and external audit engagements, then track every finding through its life — open, in progress, and closed — with FFIEC-style priority levels including MRIA and MRA, management response, target dates, and evidence of remediation. External engagements completed outside the platform can be logged so the program record stays complete.

• Findings with MRIA / MRA / High / Moderate / Low priority
• Status tracking across open, in progress, and closed
• Management response, owner, target date, and remediation evidence
• External engagement log for third-party audits and exams

Compliance Mapping

Obligations tied to owners, policies, and proof.

Each regulatory obligation carries an owner, the policy that addresses it, and the evidence that demonstrates performance. Gaps become visible between exam cycles instead of during them.

• Obligation register with named accountable owners
• Automatic linkage from policies and training to obligations
• Coverage gaps surfaced before the examiner finds them

Reporting

The exam packet, generated.

Cross-module reporting assembles policy status, training completion by employee with dates, complaint detail, risk posture, audit findings, and control evidence into a single branded document with a table of contents and page references. Reports open in the app for review first; download stays an option, not the default.

• Regulatory Exam Summary report with auto-generated table of contents
• Employee-level training detail with completion dates
• "NA" stated explicitly where there is genuinely no activity
• In-app preview, with export when you want the file