Every standard, mapped.
Every claim, evidenced.

Clauses 4–10 — the management system itself: policy, risk register, SoA, internal audit

A complete, version-controlled ISMS document suite: Information Security Policy with seven measurable objectives, a populated 5×5 risk register with named treatments, a Statement of Applicability covering all 93 Annex A controls with per-control evidence pointers, and a formalised internal-audit and access-review programme.

A.5.15 Access control — role-based, least-privilege, segregation of duties

Every screen and API is gated by a tenant-scoped RBAC matrix with delegation-of-authority chains, four-eyes approvals, and SoD checks at the schema layer (not just the UI). Cross-kind protection prevents client admins from modifying internal staff and vice-versa.

A.5.31 Compliance with legal, statutory, regulatory, contractual requirements

Standards-mapping registry (this page) plus a per-tenant compliance configuration that toggles IFRS / US GAAP / GASB books per entity. Privacy requests, data-subject rights, and breach-notification timers are baked into the workflow engine.

A.8.5 Secure authentication — MFA, password complexity, session timeouts

Email-verified accounts (EmailVerifiedAt stamp), failed-login lockouts, JWT-based sessions with refresh tokens, optional SSO / OIDC, time-boxed sensitive-action re-auth.

A.8.15 Logging — tamper-evident audit log of access + state changes

AuditInterceptor (SaveChanges hook) records who/what/when/why on every entity write. CreatedBy + CreatedDate are server-stamped from the JWT subject claim — never user-typed — and surfaced on the Fixed Asset Register and every asset detail page.

A.8.24 Use of cryptography — encryption at rest and in transit

TLS 1.2+ for every transport. Database encryption at rest. Sensitive credentials (ERP integrations, SMTP, OAuth secrets) sealed with column-level encryption.

ITGC: change management, access management, computer operations, program development

Branch-protected source control with mandatory PR review. Access changes flow through approval workflow. Backup + restore drills run on a published cadence (RTO 1h / RPO 5min). Every release is reproducible from a tagged commit.

Application controls: completeness, accuracy, validity, restricted access

Server-side validation on every monetary field, three-way matching (PO → GRN → invoice) for additions, mandatory tag-uniqueness enforcement at the database constraint level, and tenant-scoped query filters that no API path can bypass.

Segregation of duties — preparer ≠ approver ≠ payer

Workflow templates for additions, transfers, retirements, and write-offs each enforce a four-eyes (or six-eyes for high-value) approval chain. SoD violations are flagged at submission, not after the fact.

Audit trail: who, what, when, why for every financial event

Every Asset, Lease, Capex, Maintenance, Verification, Transfer, Retirement, and Insurance record carries CreatedBy / CreatedAt / UpdatedBy / UpdatedAt — populated by the AuditInterceptor on every save path with no opt-out. The Asset Detail page surfaces this in a dedicated "Audit & Provenance" panel for auditor walkthroughs.

Evidence retention — 7 years for SEC registrants

Soft-delete semantics across the entire schema (no hard deletes from the UI). Long-term archive policies configurable per entity. Deleted records remain auditable and indexable.

CC6 Logical & physical access — provisioning, MFA, periodic re-certification

Joiner-Mover-Leaver workflow with quarterly access review, MFA enforced for admin roles, automatic disablement on user termination event (HRIS webhook).

CC7 System operations — change, incident, vulnerability, monitoring

Versioned migrations, blue-green deploys, SLO + error-budget telemetry, public status page, incident runbook with named on-call rotation.

A1 Availability — capacity, environmental, recovery

Multi-AZ deployments, autoscaling, scheduled DR drills, cross-region failover documented and tested.

C1 Confidentiality — data classification + handling

Tenant isolation is enforced server-side through global query filters, tenant-scoped authorization claims, and strict data partitioning across all query and API paths.

§9 Recognition criteria — future economic benefits, cost reliably measurable

Capex Project workflow funnels every spend item through gating (Approve → Order → Receive → Capitalise) before an Asset record is created. The Asset Detail page links back to the originating Capex project for full audit drilldown.

§43 Componentisation — significant parts depreciated separately

Asset hierarchy (Master / Sub-asset) plus parallel valuation books let you depreciate the chassis on one schedule and the engine on another, while reporting both as a single asset on the FAR.

§50 Depreciation — systematic basis, residual + useful life reviewed annually

Five depreciation methods built-in (Straight-Line, Declining Balance, Sum-of-Years, Units-of-Production, Manual). Useful life and salvage value are first-class fields with audit-logged change history. Recompute is a one-click operation.

§31 Revaluation model with periodic appraisal + OCI movement

AssetValuationEvent records each fair-value adjustment with method (Cost / Market / Income), level (1/2/3), before/after amounts, and gain/loss split. The journal posts revaluation surplus to OCI automatically.

§67 Derecognition on disposal or when no further benefit expected

Retirement workflow (FA Retirement Form V2.3) captures method (Sale / Donation / Scrap / Write-off), proceeds, gain/loss, and journals the disposal in one approved transaction.

§22 Right-of-use asset + lease liability at commencement

A new Lease record auto-computes the present value of fixed payments at the discount rate, books the ROU asset on one side and the liability on the other, and emits the opening journal.

§32 Subsequent measurement — interest unwind + ROU depreciation

Monthly amortisation schedule pre-computed for the entire lease term. Interest expense and depreciation post automatically every period close. LeaseLiabilityOpeningBalance is a reportable field on the asset detail.

§44 Modification — re-measure liability, adjust ROU

Lease modification workflow re-presents the new payment schedule, recomputes the discount unwind, and posts the adjustment to the ROU asset — all in one approved transaction.

§5 Short-term + low-value exemption

Per-lease toggle for short-term (≤12 months) or low-value treatment — those leases skip the on-balance-sheet flow and post to P&L straight-line.

Lease classification test — finance vs. operating

Lease wizard runs the five classification tests (transfer of ownership, bargain purchase, lease term, present value, specialised use) at commencement and stamps the resulting class on the record.

Operating lease — single straight-line lease cost

For operating leases, Osolix booked one straight-line lease cost per period, while still maintaining the underlying ROU and liability for disclosure.

Finance lease — interest expense + ROU amortisation reported separately

Finance-lease records post interest and amortisation as two distinct lines, matching the ASC 842 income-statement geography.

§9 Indicators of impairment — internal + external

Drift Watcher Hub aggregates external (market price), internal (technical-obsolescence flag, RUL prediction), and macro (interest-rate change) indicators. Each indicator drives a configurable alert threshold.

§59 Recognition + measurement of impairment loss

When recoverable amount falls below carrying amount, the platform proposes an impairment journal (debit P&L, credit accumulated impairment). One-click approval posts the entry and stamps the asset with ImpairmentAmount + ImpairmentDate.

§110 Reversal of impairment loss

Impairment reversal is a first-class workflow: re-test → propose reversal up to original carrying amount → post entry → audit-log the change.

§72 Fair value hierarchy — Level 1 / 2 / 3

AssetValuationEvent.Level is a required field on every revaluation record. The Investment Property tab and Lease tab both expose level + method side-by-side for disclosure-note generation.

§91 Disclosure of valuation technique + significant unobservable inputs

Each valuation event captures method (Cost / Market / Income), input description (free-text + structured), and the responsible appraiser. The audit committee report template renders this directly.

ASC 360 Property, Plant and Equipment — capitalisation, depreciation, impairment

AssetBook records each book's policy independently — Corporate (book) for IFRS, Tax (alternate) for US-GAAP MACRS, Local for jurisdictional overrides. Reports filter by book.

ASC 350 Intangibles — goodwill + other intangibles

Asset classification supports Intangible items with their own amortisation rules, indefinite-life flagging, and annual impairment-test reminders.

ASC 410 Asset Retirement Obligations

Per-asset AroAmount field, with discount-unwind schedule and journal posting. The retirement workflow trues-up the actual disposal cost against the booked ARO.

§19 Capitalisation of infrastructure assets

Infrastructure-class assets get the same lifecycle as standard PPE plus a condition-assessment workflow that drives the modified-approach disclosure.

§23 Modified approach — preserve at established condition level

Per-asset condition score with target threshold; a deviation triggers a maintenance project recommendation rather than depreciation.

Required Supplementary Information — condition + preservation costs

GASB-34 RSI report renders the condition assessment by asset class, the preservation expenditure, and the comparison to the established condition level.

Strategic Asset Management Plan (SAMP) — line-of-sight from org strategy to asset action

Capex Project module ties spend to a strategic objective; Maintenance Plans tie work-orders to availability targets; the Reporting hub rolls them up into a single SAMP narrative.

Risk-based decision-making across the lifecycle

Risk score on every asset, RUL prediction in the Maintenance hub, repair-vs-replace banner on the asset detail, and a cost-of-failure heatmap in the Maintenance hub.

Performance + condition monitoring with continuous improvement loop

Verification cycles, IoT-fed anomaly alerts (RUL heatmap), and a quarterly review board template — all instrumented so every cycle's outcome feeds the next plan.

Art. 15 Right of access

Self-service Privacy Request portal at /privacy/request. The DSR queue routes the request to the DPO, the platform compiles the personal-data dossier, and delivery happens within the regulatory window.

Art. 17 Right to erasure

Erasure workflow soft-redacts personal identifiers across all records while preserving aggregate financial entries (which are required for SOX retention). The redaction event is itself audited.

Art. 30 Records of processing activities

Published Records of Processing document on the Trust Center, kept current for every new sub-processor or processing purpose.

Art. 35 Data Protection Impact Assessment

Published DPIA covering processing inventory, risk assessment, and mitigation. Triggers re-assessment when a new high-risk feature ships (e.g. AI agents, biometrics).

Art. 33 Breach notification within 72 hours

Incident-response playbook with a built-in 72-hour timer that auto-escalates to the DPO and notifies affected tenants from the same console.

Data residency within the regulated jurisdiction

Per-tenant region selection at provisioning. Backups stay in-region. Cross-border transfers happen only via the customer's explicit configuration and with documented adequacy.

Arabic-language privacy notice + consent flows

Native Arabic UI across the entire product (RTL-aware), Arabic privacy notice, Arabic-language DSR portal.

Data Protection Officer designation + contact

The Trust Center explains how to send a data-subject request through our contact form, with a 30-day response commitment.

Documented procedures + records

Every workflow (additions, transfers, retirements, maintenance, audits) is governed by a configurable template stored in the Workflow Designer. Each execution leaves a record.

Continual improvement — corrective + preventive action

Anomaly detection feeds the maintenance backlog. Verification discrepancies become CAPA tasks. Quarterly review boards close the loop.

Document control with revision history

Every form (Transfer V2, Retirement V2.3, Verification, Capex) is versioned with a publish-date stamp. Superseded versions remain readable.

Perceivable — adequate contrast, alt text, captions

Brand palette tested for AA contrast across both light and dark themes. Every image carries alt text. Charts include a hidden summary table for non-visual access.

Operable — keyboard, no seizure-inducing motion

Full keyboard navigation across every screen. Motion respects prefers-reduced-motion. Focus indicators are gold-accented for high visibility.

Understandable — predictable, helpful errors

Consistent navigation patterns (canonical PageHero + PageTabs across every page). Inline error messages are specific, actionable, and announced to screen readers.

Robust — works with assistive technology

Semantic HTML, ARIA where it adds clarity, and tests against NVDA + VoiceOver before each release.