75 lines
2.5 KiB
Markdown
75 lines
2.5 KiB
Markdown
# GovOPlaN Risk Compliance
|
|
|
|
<!-- govoplan-repository-type:start -->
|
|
**Repository type:** module (domain).
|
|
<!-- govoplan-repository-type:end -->
|
|
|
|
`govoplan-risk-compliance` owns risk and compliance workflows for data protection incidents, DPIAs, compliance controls, audit measures, risk registers, internal-control evidence, and legal screening decisions.
|
|
|
|
Its runtime module ID is `risk_compliance`; the repository and Python distribution retain the hyphenated `govoplan-risk-compliance` name.
|
|
|
|
The first complete vertical is sanctions screening. Connectors acquires immutable source evidence; Risk Compliance imports and normalizes exact list versions, runs deterministic version-pinned screening, and presents potential matches to an independent reviewer. Fuzzy matching only creates review candidates and never confirms a legal match.
|
|
|
|
The module includes database migrations, tenant-isolated APIs, an operational WebUI, append-only dispositions, time-bounded false-positive exceptions, and audit events. Queue and audit summaries deliberately retain only the minimum subject data needed for the workflow.
|
|
|
|
## Initial Ownership
|
|
|
|
- risk registers
|
|
- compliance controls
|
|
- DPIA records
|
|
- data protection incident records
|
|
- audit measures
|
|
- internal-control evidence
|
|
- immutable sanctions list catalogues
|
|
- sanctions screening and reviewer dispositions
|
|
|
|
## Boundaries
|
|
|
|
This module does not own:
|
|
|
|
- immutable audit log storage
|
|
- records retention engine
|
|
- inspection fieldwork
|
|
|
|
Detailed boundary notes are in [docs/RISK_COMPLIANCE_DOMAIN_BOUNDARY.md](docs/RISK_COMPLIANCE_DOMAIN_BOUNDARY.md).
|
|
|
|
## Integrations
|
|
|
|
Expected optional integrations:
|
|
|
|
- audit
|
|
- policy
|
|
- records
|
|
- inspections
|
|
- files
|
|
- tasks
|
|
- notifications
|
|
- connectors
|
|
|
|
## Development Install
|
|
|
|
From the core checkout:
|
|
|
|
```bash
|
|
cd /mnt/DATA/git/govoplan-core
|
|
./.venv/bin/python -m pip install -e ../govoplan-risk-compliance
|
|
```
|
|
|
|
Focused manifest verification:
|
|
|
|
```bash
|
|
cd /mnt/DATA/git/govoplan-risk-compliance
|
|
PYTHONPATH=src:/mnt/DATA/git/govoplan-core/src /mnt/DATA/git/govoplan-core/.venv/bin/python -m unittest discover -s tests
|
|
```
|
|
|
|
## Gitea Workflow
|
|
|
|
Issue templates are installed under `.gitea/`, and the shared label taxonomy is copied to `docs/gitea-labels.json` with the module label `module/risk-compliance`.
|
|
|
|
From the core checkout, labels can be synced once a local `GITEA_TOKEN` is available:
|
|
|
|
```bash
|
|
cd /mnt/DATA/git/govoplan-core
|
|
/mnt/DATA/git/govoplan/tools/gitea/gitea-sync-labels.py --root /mnt/DATA/git/govoplan-risk-compliance --apply
|
|
```
|