27. Compliance-control register and risk-based audit coverage
Govern tenant-entered obligation mappings and risk-based coverage without hard-coded clauses or authority to execute audits and source-domain work.
Purpose
Govern tenant-entered obligation mappings and risk-based coverage without hard-coded clauses or authority to execute audits and source-domain work.
Compliance Manager, different QA Head register approver, Quality Audit Manager, second QA Head coverage reviewer, Quality Engineer process owner, Internal Auditor, Auditor read-only
QA-ANNEX-7 → register v1 rejected → immutable v2 approved → coverage v1 rejected → immutable v2 approved with one high-risk exact Flow 17 audit and one bounded lower-risk treatment.
Before you begin
- Compliance Manager, Quality Audit Manager, two different QA Head users, Quality Engineer process owner and Auditor are active, site-scoped and cleared
- At least one same-site ACTIVE, CLEAN document version exists
- Any scheduled or recent audit already has an exact approved Flow 17 programme and plan
- The tenant has licensed obligation text and has decided applicability; Moduvio does not supply or claim a standard edition
Obligation mapping, risk coverage and authority boundaries
Choose STANDARD, CUSTOMER, CONTRACT, REGULATORY or INTERNAL and enter issuer, title, edition/change and source reference. Moduvio stores these facts but does not assert their currency or conformity.
Obligation and clause references are tenant-entered text. No standard clause number is hard-coded into validation or workflow logic.
Each immutable version records applicability/rationale, process owner, configured workflow/control, evidence, retention, segregation, report, test, risk and gap. Applicable controls require a cleared same-site Quality Engineer owner.
QA rejection preserves the version. An approved register remains active while an amendment draft/review exists, and only a later approval supersedes the prior active version.
Every applicable control must appear exactly once in the coverage version; not-applicable controls cannot be included.
Scheduled coverage requires an active approved Flow 17 plan inside the cycle. Recent coverage requires a CLOSED approved audit inside the declared lookback. Site and classification must match exactly.
A treatment names a Quality Engineer, target date, external treatment reference and rationale. QA cannot approve it for a HIGH/CRITICAL control or a score at/above the cycle threshold.
The register author cannot approve the register. The coverage author cannot review coverage, and the QA user who approved the register cannot approve its coverage.
Flow 21 creates zero notification deliveries and never changes the Flow 17 audit/plan, NCR, supplier, product configuration, current_stock or stock_ledger records.
Procedure
- 1
Create register v1 as Compliance Manager with two applicable controls and CLEAN evidence; submit and reject it as the first QA user.
- 2
Create immutable register v2, submit it and approve it as that independent register QA authority.
- 3
Create coverage v1 as Quality Audit Manager against the exact active register version; map high risk to an approved Flow 17 audit and a lower risk to a bounded treatment.
- 4
Submit coverage and prove the original register approver is blocked. Reject v1 as a second QA user, create/submit v2 and approve it independently.
- 5
Read as Auditor and reconcile both version histories, exact audit snapshot, evidence, audit/outbox facts and zero source-domain changes.
Expected result
- Register lifecycle supports DRAFT → REGISTER_REVIEW → ACTIVE and immutable amendment/rejection versions
- Coverage lifecycle supports DRAFT → COVERAGE_REVIEW → APPROVED and immutable amendment/rejection versions
- Compliance Manager, register QA approver, Quality Audit Manager and coverage QA reviewer are four different user IDs
- Clause references remain free tenant-entered text
- Every applicable control appears exactly once and not-applicable controls are omitted
- High/critical and above-threshold risk cannot be approved as gap treatment
- Scheduled/recent audit coverage resolves to an exact approved same-site, same-classification Flow 17 plan
- Rejected register and coverage versions remain immutable
- Flow 21 creates zero notification deliveries and never changes audit, NCR, supplier, configuration, inventory or ledger records
- Auditor mutation attempts are rejected