Comply
Evidence assembled as the work happens
- The problem
Audit preparation is usually archaeology — reconstructing months later what was true at the time. AwardBase records it at the time, because that is the only moment it is cheap.
- What the system contributes
It reads the sources, extracts what they require, and keeps every derived figure attached to the record it came from — so a number can be checked rather than trusted.
Obligations and controls
Derived obligations
BuiltObligations derive from the approved reading of the award terms, with due dates computed from the rule the terms state. Satisfying one is refused when the terms have moved underneath the decision.
Control states and attestation
BuiltCompliance controls with a state, an owner and an attestation bound to the exact state fingerprint being attested to.
Assurance runs
BuiltRuns that produce findings, with dispositions that record who accepted a risk and on what basis.
Control graph
BuiltControls that know how they depend on each other, so when one fails you can see what else now rests on something that is not there. A control resting on a failure is reported as unsupported rather than failed — nobody has assessed it, and saying otherwise would invent an assessment.
Continuous control monitoring
BuiltControls re-checked against a shelf life set per control, so an assessment made in March does not still read as current in September. A control past its shelf life is reported as stale rather than failing — nobody has found a problem — and evidence ages separately from the assessment, because a shared document ages under everything that cites it.