Overly Bureaucratic cultures got that way for a reason, and it is rarely worth your time trying to beat them looking for the best task tracking software. Play for the next level - managing the risk from the projects.
But I have to suggest that if you are being allowed to choose your own task tracking tools, things are more flexible than might at first seem.
I suggest using fogbugz from Joel Spolsky. It gives simple task tracking, plays well with most other systems, has a decent API so you can script custom output. Atlassian works well too in those respects but fogbugz is just better thought out.
Keep the risk reports as an addendum to whatever reports you need to satisfy the external auditors - eventually you will be seen as first player in the fun new game
But will totally read that book rec, appreciate it!
I would be tempted to ask the person(s) who will be acting as your overlords what they really want. Setting up digital teams is hard enough without having vague expectations and delivering wrong outcomes. If all they really want is a RAG Status for two projects then you need to talk about SLAs and recovery and mitigation options (risk management) not set up and learn another tool.
Do let me know more - really interested to get a feel for what your situation is. Just nosy is all :-)
I've found the right tool is so incredibly team/company specific that third party advice on these matters is often useless, but I'll share a few additional data points in case they help.
1) I recently helped a 40 person dev team rethink their dev tools and they chose to adopt Trello, roughly using this post as a guide: https://community.uservoice.com/blog/trello-google-docs-prod...
The team was using Pivotal and will continue to do so, but adding the Trello layer on top allows the "bureaucratic overlords" the info they need to a) stay informed, and b) make better decisions on resource allocation.
2) If giving the business folks a window into dev progress is important, also check out Sprintly. They do a great job at that.
Good luck!