The Audit File For The Safety And Quality Work Already Happening

Evidence is polymorphic. Each piece of proof either links to an existing record — a Safety Hub incident, CAPA action, toolbox talk or observation, an inspection, a policy, an SOP, an employee certification, a vendor certification, a change request — or attaches an uploaded file (one of the two is required). Because evidence points at the live record, it stays current instead of going stale like a re-keyed copy in a standalone tool.

Each control has a review frequency (monthly, quarterly, semiannual, annual, or ad-hoc) that auto-schedules its next review date. A daily job opens a draft campaign for any control past due, the campaign fans out one attestation item per subject, reviewers attest / flag / mark N/A, and on completion the campaign locks read-only for audit integrity.

The library seeds seven curated starter catalogs — SOC 2, SOX ITGC, ISO 27001, HIPAA, ISO 45001, ISO 9001, and ISO 14001 — 122 controls in total, each with guidance and an evidence hint naming the MangoApps record that satisfies it. You import a whole framework in one click or just the gaps you're missing, and a coverage matrix shows imported vs still-missing controls per framework. 113 crosswalks mark control equivalence (exact / partial / related) so a second framework can borrow controls you already have. Catalogs are curated starters, not the full official texts, and are maintained by MangoApps rather than edited per tenant.

Compliance Hub produces XLSX or PDF export packages that snapshot controls, sign-off trails, and evidence as a point-in-time deliverable — a full XLSX export also carries the Risk Register and Legal Register sheets. Exports can run on a monthly, quarterly, or annual schedule, and a published export can be shared through a read-only auditor portal link with an optional expiry and a revoke, so the auditor never needs a MangoApps account. Every export is recorded in an immutable export history — who pulled what, when — so the exports themselves are auditable.

Flagging a review item automatically creates a finding — a tracked deficiency with an owner, severity, and due date that moves open → in-progress → remediated / accepted / closed. It's the audit loop a bare "flagged" status can't close on its own, so nothing falls through the cracks.

The risk register rates each risk on a 5×5 likelihood × impact grid — an inherent score and an optional residual score after treatment — with an owner, a treating control, a site, a mitigation plan, and a review cadence. Serious incidents and near misses from Safety Hub, failed inspections, and open regulator visit findings are suggested for the register and pre-filled from the source record. The legal register lists the laws, permits, and contractual obligations the program answers to, each with a citation, jurisdiction, compliance status, implementing control, and evaluation cadence; obligations are suggested from the employment-law catalog for the jurisdictions your locations are mapped to. Both registers accept linked evidence and ship as sheets on a full auditor export.

The agent summarizes compliance posture, lists controls and campaigns, surfaces your pending attestations, finds evidence gaps, reports framework coverage, lists open findings, and queries the risk and legal registers — nine read tools. It can also create a control or launch a review campaign, both confirmation-gated with a diff preview before anything is written. Eleven tools in total. See the agent page for the full list.