Compliance Hub

Yes. The catalog ships curated ISO 45001, ISO 9001, and ISO 14001 clause sets alongside SOC 2, SOX, ISO 27001, and HIPAA, crosswalked across the harmonised management-system clauses. Each ISO clause's evidence hint names the record MangoApps already keeps — a Safety Hub incident investigation, an inspection, a CAPA action, a toolbox talk, a policy, an SOP — and those records link in as evidence.

The risk register rates each risk on a 5×5 likelihood × impact matrix with inherent and residual scores, an owner, a site, a treating control, and a review cadence; it suggests risks from serious incidents, near misses, failed inspections, and regulator visit findings. The legal register lists the laws, permits, and contractual requirements you are bound by with a citation, authority, applies-to, compliance status, and evaluation cadence, and suggests employment-law rules for your mapped jurisdictions. Both appear on the dashboard, in search, and on the full auditor export.

Yes. Seven platform-curated catalogs — 122 controls with 113 crosswalks — are authored in the MangoApps Console. A tenant imports a whole framework, one category, or just the gaps in one click, and crosswalks let one control satisfy several frameworks at once. The catalogs are curated starter sets, not the exhaustive official standards.

No. A native vendor/change register makes certification and change reviews work standalone. When Safety Hub, Inspections, Asset Pro / Supplier Hub, Contracts, Service Desk, Policy Hub, or SOP Hub are present, their records link in as evidence or feed the registers, and Compliance Hub dedupes against them.

A completed campaign is locked: its items and evidence become read-only for audit integrity. An admin can explicitly unlock it for re-attestation, which reopens the campaign and replaces the earlier sign-off with the new one. The unlock is logged.

A multi-sheet XLSX workbook (or a PDF) snapshotting controls, campaigns, sign-off trails, and evidence; a full export also carries the Risk Register and Legal Register sheets. Exports run on demand or on a monthly, quarterly, or annual schedule, are never deleted, and can be published as a token-gated read-only portal with an optional expiry — or anonymous links can be switched off for the tenant.

Evidence is either a linked live record — a vendor certification, contract obligation, change request, employee certification, incident, CAPA action, toolbox talk, safety observation, inspection, policy, or SOP — or a file you upload (up to 25 MB). Each evidence record can carry an expiry date. You can require evidence before an item can be attested, auto-collect it from linked records, and gate downloads behind step-up identity verification — each an admin toggle, off by default.

They do the work; Compliance Hub is the audit file. Safety Hub runs incidents, inspections feed CAPA, Policy Hub authors policies with acknowledgments, and SOP Hub tracks procedures. Compliance Hub maps those records to framework clauses, rates the risks they surface, tracks the obligations behind them, runs the attestations, and hands an auditor the package.

The agent answers read questions — controls, posture, your pending attestations, evidence gaps, framework coverage, findings, the risk register, and the legal register — for anyone with app access. People who hold the manage capability can also ask it to create a control or launch a review campaign; those writes route through the same controller as the UI, show a diff preview, and require an explicit Confirm. Who may manage the program is a per-tenant capability setting: app admins only by default, or specific groups.