Workflow

Flow 21 — Compliance-control register and risk-based audit coverage

Version applicable obligation-to-control mappings, approve them independently, then cover every applicable control through one exact approved Flow 17 audit or a bounded lower-risk treatment.

Overview

Inventory meaning

Flow 21 is governance-only. It snapshots exact Flow 17 programme/plan facts and never creates or changes an audit, finding, NCR, supplier action, product configuration, custody transaction, stock balance or external message.

Responsible roles

Compliance Manager → different QA Head register approver → different Quality Audit Manager → different QA Head coverage reviewer → Quality Engineer / Internal Auditor source work → Auditor read-only

Process

1
Obligation map
Enter free references, applicability, controls, owners, evidence and risk.
Immutable register draft · no source update
2
QA register gate
Reject for immutable replacement or approve the complete mapping.
Independent register authority
3
Risk coverage
Map every applicable control once to audit or bounded treatment.
Exact Flow 17 read snapshot
4
QA coverage gate
A second QA user rejects or approves risk-based completeness.
High risk requires audit coverage
5
Approved coverage
Retain versioned decisions, evidence and source snapshots for audit.
Read-only governance history
READ ONLY

Role handoff

Detailed reference chapters

Compliance-control register and risk-based audit coverage Quality audit programmes, findings and closure Nonconformance and CAPA governance Controlled documents and evidence roles

Detailed steps

1
As Compliance Manager, open Quality → Compliance controls and create register v1 for a standard, customer, contract, regulatory or internal source. Enter the edition, source reference and free obligation/clause text; for every control record applicability, rationale, process area/owner, configured control, evidence, retention, segregation, report, test and risk/gap state.
2
Submit v1. As a separate QA Head, reject it and confirm the version and control snapshots remain immutable. Create v2, submit it and approve the complete mapping independently; the Compliance Manager cannot approve.
3
As Quality Audit Manager, create a coverage cycle against the exact active register version. Include every APPLICABLE control exactly once and omit NOT_APPLICABLE controls. Bind audit coverage to one exact approved Flow 17 plan or give a lower-risk gap a named Quality Engineer, target date and treatment reference.
4
Submit coverage v1. Confirm the original register approver cannot review it. As a second QA Head, reject v1, retain it, then independently approve corrected immutable v2 only after every high/critical or above-threshold risk uses an exact approved audit.
5
As Auditor, reconcile four distinct governance actors, CLEAN evidence links, register/coverage version history and the frozen audit snapshot. Confirm the referenced audit and plan, inventory, ledger and notification-delivery state did not change.

Field-by-field practice data

Use a disposable training tenant

Create one versioned obligation-to-control register for a training contract requirement. The page shows sample set A; the workbook includes independent A, B and C values.

Download all workflow samples (.xlsx)

Field names match the current application labels. Select existing approved records where shown, leave optional values blank unless they genuinely apply, and never copy fictitious TRAIN values into live work.

Compliance Manager

Create the compliance register

Open /quality/compliance-controls

Define the source authority and add one explicit control mapping before independent approval.

Exact field name	Requirement	Sample value A	How to use it
Site	Select existing	`COM-01`	Select the governed site.
Authority type	Required	`CONTRACT`	Choose the source obligation type.
Classification	Required	`RESTRICTED`	Match the source and evidence.
Issuer	Required	`Training Customer A`	Use the exact issuing authority.
Register title	Required	`TRAIN-A contract control register`	Use a unique controlled title.
Edition / contract change	Required	`Change 01`	Record the exact source edition.
Source reference	Required	`TRAIN-A-CONTRACT clause 7.4`	Use free controlled reference text.
Effective from	Required	`2026-10-01`	Record the source effective date.
Scope	Required	`Inbound material, batch traceability and supplier evidence.`	Bound the applicable operations.
Applicability basis	Required	`Applies to all TRAIN-A direct material purchases.`	Explain why the obligation applies.

Expected result: The register records applicability and evidence requirements; it does not execute or replace the configured workflow.

End state

One active obligation register and approved coverage cycle retain immutable rejected/approved versions, independent QA gates, complete applicable-control coverage and exact Flow 17 snapshots without acquiring audit execution or source-domain authority.