Assurance & obligations

Compliance

Turn standards and internal controls into traceable obligations, due dates and evidence instead of managing compliance as a static checklist.

Editing typically requires manage_tenant_settings or manage_asset_compliance

Compliance Packs

A compliance pack groups related requirements, such as a regulation, recognised standard or internal control framework. Apply relevant packs to create a repeatable compliance baseline rather than adding every requirement manually.

From the pack view, authorised users can move into coverage and obligation tracking. Packs are the organising layer; the evidence register is where compliance becomes operational.

Compliance coverage

Coverage views summarise posture and identify gaps. Use them to find requirements that are not currently supported by the expected inspection or evidence record. A clean dashboard is only meaningful if the relevant requirements have actually been configured and applied.

Compliance Obligation Engine

The obligation engine allows the organisation to define a compliance requirement in operational terms. A structured obligation can include:

• Standard or regulation and requirement code/title.
• The requirement text and applicable control.
• Frequency and first due date.
• Expected evidence.
• The assets to which the obligation applies.

This creates a portfolio evidence register rather than relying on someone to remember when a recurring control is next due.

Evidence register

The evidence register can show the asset, site, control, frequency, current state, next due date and latest evidence. When recording evidence, the user can capture the compliance result, completed/assessed date, evidence URL or reference/key, notes and the next due date.

How inspections support compliance

An inspection can supply evidence for a control, but a completed inspection is not automatically proof that every relevant compliance requirement has been met. Review the applicable obligation, expected evidence, inspection coverage and any unresolved limitations before relying on the result.

If the inspection identifies a failing condition or incomplete evidence, use Corrective Actions and the limitations workflow rather than closing the compliance gap prematurely.

Exporting compliance evidence

Where available, export the evidence register when a structured external or internal review needs a portable record. For a controlled external review containing selected inspections and evidence, use the External Auditor / Client Evidence Portal instead of broadly distributing internal access.