Multi-framework programs with built-in intelligence
SOC 2, ISO 27001, HIPAA, NIST CSF 2.0, GDPR, CCPA, COSO, and TISAX are seeded frameworks with ~100 cross-mappings between them. Add a second framework and the system calculates how much of it your existing controls already cover. The Control Intelligence engine scores every control candidate from five deterministic signals — requirement overlap, framework domain, governance peers, evidence overlap, and text similarity — and surfaces gaps and near-duplicates without calling any external API. Dismissed suggestions re-surface automatically when their score drifts more than 10 points.
Audit workflow with real evidence accountability
An audit cycle runs planning → fieldwork → reporting → complete. Test executions are recorded with samples, results, and evidence attachments and are immutable once saved. Cycle closure is gated: any control test with zero executions in the fieldwork window blocks completion, with an override path that requires a minimum-length reason and produces an audit record of every skipped test. Evidence packages are deterministic SHA-256 manifest ZIPs. HMAC-signed share tokens reveal their URL exactly once, so the auditor gets the file and you know when it was opened.
SOX from ICFR to audit committee
SOX programs run COSO controls across financial accounts with PCAOB assertion linkage. The RCM joins controls, risks, accounts, assertions, open finding counts, and latest test results into one view. Walkthroughs trace transactions step-by-step with enforced separation of duties — the preparer cannot approve their own work, enforced at the backend on every request. §302 sub-certifications dispatch to named respondents who are personally accountable for their response; only the named respondent can complete or decline. The audit committee dashboard aggregates deficiency scoring, test completion, remediation status, attestation progress, control coverage, and a six-period deficiency trend in a single response.
Remediation that actually closes
The remediation bridge opens Jira tickets automatically when a finding is finalized or a control test fails — not just when someone manually clicks "create ticket." Event subscriptions route alerts, findings, and MAP items to the bridge and can override the target Jira project per subscription. Ticket status syncs back on schedule and drives the internal state machine. When Jira marks a ticket done, the linked MAP action item auto-advances. Finding root cause analysis — categorized across eight types including process, technology, policy, and configuration — remains editable through the full finding lifecycle, so what you learned during remediation lands where it belongs.
