Integrations and source ownership

• Identity source. Map named users to team members and organizations so ownership and reviewer independence can be checked.
• Evidence repository. Agree how a test evidence reference resolves to its source and how files are attached to an assessment.
• Control source. If controls are maintained elsewhere, map risk, owner, effective date and status before importing them.
• Regulator reference source. Maintain the agreed reference and control area used on prudential review records.

Choose one source owner for each field, stable identifiers and a retry policy before connecting another system. A repeated operation key should return the same accepted effect. Investigate Failed or needs review operation receipts before issuing a fresh key. Keep credentials in the approved secret store and verify that Internal evidence stays within its intended audience. Reconcile accepted, rejected and pending work during the first operating cycle.

Plan the implementation.