Appearance
Requirements & Obligations
In OrviQ, Requirements represent individual rules, clauses, or statutory mandates within a compliance framework.
Obligation Decomposition
Complex regulatory articles often contain multiple distinct requirements within a single text block. OrviQ supports decomposing a regulatory section into granular, independently verifiable sub-obligations.
Each requirement captures:
- Framework & Clause Code: E.g.,
UAE-IA::5.1.2orISO-27001::A.8.1. - Title & Description: The exact statutory text and contextual intent.
- Scoping Status: The applicability decision recorded against the framework adoption.
- Mapped Controls: Supporting internal controls linked via the Control Crosswalk.
- Attached Evidence: Assertions and artefacts demonstrating fulfilment.
- Compliance Determination: The authoritative position on whether the requirement is satisfied.
Determination states
A requirement's position is expressed on two independent axes. Confusing them is the most common reading error.
Requirement satisfaction, the objective verdict
| State | Meaning |
|---|---|
not_assessed | Insufficient evaluated information to conclude. The baseline state |
satisfied | Mapped controls effective, evidence current, coverage complete |
partially_satisfied | Genuine but incomplete assurance |
not_satisfied | A mapped control is ineffective, or direct evidence failed |
not_applicable | Governed as excluded through an approved applicability decision |
Governance disposition, the organisation's position
| State | Meaning |
|---|---|
unassessed | No determination reached |
compliant | Satisfied, with no deviation applying |
accepted_deviation | An approved exception is in force |
remediation_required | Partially or not satisfied; remediation owed |
The Requirements register displays these using product vocabulary: Complied, Partially Complied, Not Complied, Accepted Risk, Awaiting Evidence, Awaiting Review, Not Applicable and Not assessed, each with the source of the position.
See Compliance Determination for how each is derived, and Status Definitions for the complete vocabulary.
Compliance Principle
A requirement's determination is derived from evaluated evidence and signed by an accountable person. It is never promoted to satisfied merely because a control has been mapped. See Separation Principles.