Connections

• Authority sources. Decide where the team will check the original regulatory text referenced by an obligation and how its source identifier is recorded.
• Evidence repository. Decide where sample material and corrective proof live when a test or action stores a text reference instead of the file itself.
• File access. Confirm who can open files attached to assessments and how Internal and Shared visibility maps to the organization’s intended audience.

The organization chooses each source and its access rules. A reference in a record should take an authorized reviewer to the material needed for a decision. Test that path during the first assessment, including what happens when a reviewer lacks access or the source changes. Keep the assessment, decision and result records in the app so a later reader can see why the team acted.