At its core the module manages compliance frameworks as structured, versioned objects. Each framework decomposes into requirements and clauses, and the module maps reusable controls against them so that a single control can satisfy obligations across several regimes at once. Around this spine it provides a regulatory calendar of filing deadlines, certification renewal dates and audit windows; a control library of reusable, ownable controls; questionnaire-based assessments with structured evidence collection; audit management for both internal and external audits, including findings and remediation tracking; a risk register with identification, scoring and mitigation plans; policy management covering the full policy lifecycle; an evidence vault that links documents and test results to the controls they support; and compliance dashboards that surface readiness scores, gap analysis and trends. Taken together these capabilities let an organisation demonstrate, at any moment, the state of its compliance posture across every framework it is subject to.

The domain is built from a small number of durable entities that reference each other cleanly. A Framework is the top-level regime and holds versioned requirements. A Control is a reusable statement of a safeguard, held once in the control library and mapped to the requirements of one or more frameworks through an explicit mapping entity, which is what makes cross-framework reuse and coverage analysis possible. A Risk in the register carries an inherent and residual score, an owner and a set of linked mitigating controls. An Assessment is an instance of a questionnaire run against a scope, producing responses and attached evidence. An Audit holds a scope, a schedule, Findings, and the Remediation items that close them. A Policy is a lifecycle-managed, version-controlled document with an acknowledgment ledger recording who has read and accepted each version. Underpinning all of these, the Evidence Vault stores documents and test results as first-class records, each linked to the control, assessment or finding it substantiates. Because the schema sits on PostgreSQL 16 through Prisma 7, the relationships between control, evidence, risk and finding are enforced referentially rather than left to convention, so readiness figures are computed from real links, not manual tallies.

Three processes recur through the module. The first is the control assessment cycle: a control is scheduled for testing, an assessment questionnaire is issued to its owner, evidence is gathered into the vault, the response is reviewed, and the control is marked effective, deficient or not applicable. Deficiencies raise findings and feed the readiness score directly. The second is the audit and remediation loop: an audit is planned against a scope, fieldwork produces findings, each finding is rated and assigned an owner with a due date, and remediation actions are tracked to closure with their own evidence, so an auditor can trace a finding from discovery to verified fix. The third is the policy lifecycle: a policy is drafted, routed for review and approval, published to a version, and pushed to its audience for acknowledgment, with the module tracking outstanding acknowledgments and automatically superseding prior versions. Across all three, the regulatory calendar acts as the timekeeper, driving reminders for upcoming assessments, renewals, filing deadlines and audit windows so that obligations are met on schedule rather than discovered late.

The value of a GRC module lies in the rigour of its controls handling, and this is where the module invests. Control mapping is many-to-many by design, so evidence tested once against a control counts toward every framework that control satisfies, and gap analysis can report coverage per framework without duplicating work. For SOX in particular, controls are tied to the financial processes they govern in Accounting & Control, and the module distinguishes control design from operating effectiveness, recording test dates, sample sizes and outcomes so that a control's effectiveness is a substantiated conclusion rather than an assertion. Risk scoring separates inherent from residual risk, links each risk to its mitigating controls, and lets a deficient control automatically raise the residual exposure of every risk that depends on it. The evidence vault preserves the immutability that auditors expect: evidence is versioned and time-stamped, and its linkage to a control, finding or assessment is retained even as the underlying framework requirements evolve. Acknowledgment tracking on policies produces the attestation trail required by regimes such as ISO 27001 and GDPR, showing not just that a policy exists but that the affected population has accepted the current version. Readiness scores and gap analysis are derived from these primitives, so a dashboard figure can always be decomposed to the specific controls and evidence behind it.

The module is deliberately positioned as the assurance layer over the operational suite. It integrates with Accounting & Control for SOX and internal financial controls, drawing on the same process and transaction structures the finance team works in, so that a control tested in GRC references the real accounting activity it is meant to safeguard. It integrates with Document Management for policy documents and evidence artefacts, treating that module as the system of record for files while GRC supplies the compliance meaning, version discipline and requirement linkage layered on top. It integrates with Flow Management for approval workflows, so policy publication, remediation sign-off and assessment review run through the same routing, escalation and audit-trail engine used elsewhere in the suite. Because these are genuine module-to-module links rather than exports, a change in an underlying record, a superseded document or a reopened control, is reflected in the compliance picture without re-entry, and a single obligation can pull evidence and approvals from across the organisation into one coherent view.

Nashua 360 treats AI Workers as first-class users, and in GRC they operate across the assurance lifecycle. Compliance teams can query module data conversationally, asking which controls are overdue for testing, which framework has the weakest coverage, or what evidence supports a given SOX control, and receive answers grounded in the live model rather than a static report. Workers perform document and data extraction, reading an uploaded policy or a vendor certificate and proposing the control mappings, effective dates and requirement links it satisfies, which turns evidence intake from manual filing into review. They provide anomaly and exception alerting, flagging a control whose evidence has gone stale, a risk whose residual score has drifted above appetite, or a filing deadline approaching without preparation. They offer decision support during assessments and audits, suggesting remediation steps for a finding or surfacing comparable controls that already carry tested evidence. Workers can execute actions within their granted authority, opening remediation items, scheduling assessments or issuing acknowledgment reminders. Crucially, a Worker can also act as an approval or review node in a Flow Management workflow, performing a first-pass review of a policy or a control test result and either clearing it or escalating to a human owner, with every action attributed and logged so the compliance trail records exactly which decisions a Worker made and on what basis.