Compliance Management
Import the standard. Assess once. Prove it everywhere it applies.
Every question in the library defines what each maturity level means in words. Two assessors reading the same descriptor reach the same number, an auditor can see why, and a control tested once satisfies every standard that asks for it.
- Six maturity levels, 0 to 5, each with a written definition per question
- Assessment per entity and period; delegate a domain or a single control
- Evidence request list per assessment; files reused across frameworks
- Compliance score, submit and approve, with gaps becoming owned findings
In the application · Assure
- Assessments
- Templates & questionnaires
- Evidence requests
- Control tests
- Compliance score
- Delegations
Level 3: Well Defined
A standard process is defined and followed across the organisation.
Every question in the control library carries its own written descriptor at each level.
Scoring
A defined ladder from Not Performed to Continuously Improving
Level 0 is Not Performed; level 5 is Continuously Improving. The intermediate levels — Performed Informally, Planned & Tracked, Well Defined, Quantitatively Controlled — are what make a score defensible.
- Descriptors authored per question, not per framework
- The same control assessed once, reported against every framework mapped to it
- Maturity assessed against a target, per framework where standards demand different depth
- Responses carry comments and attachments for reviewer context
Control
Privileged access is reviewed each quarter by the system owner
PPTDF applicability
One owner · one procedure · one evidence trail
Scope and control tests
Assessments that know where they apply
An assessment links to entities, departments, locations and policies, so scope is explicit. Control tests run manually or from a connected tool, on a schedule, and their results link to the findings they raise.
- Department, location and policy links per assessment
- Delegation with the delegation itself recorded
- Control test runs with results linked to findings
- Evidence held once and referenced by every mapped requirement
- PaymentsDomain
- Card acquiringCapability3 risks2 policies
- Merchant settlementService4 controls2 assets
- Daily reconciliationProcess1 risk2 controls1 finding
Every level links out to risks, controls, policies, findings, assessments, and assets
Framework alignment
Works with your control frameworks
This module shares the platform control library. International standards, sector regulations and your own internal standard are loaded the same way and mapped to one another, wherever you operate.
See compliance management in your environment
A walkthrough scoped to your entities, your frameworks, and the way your programme is actually run.