SpeamCore module · compliance
A QM system people actually use — and that still holds up in the audit.
Processes with approvals, recurring inspections, a legal register, continuous improvement, internal audits, management review, quality objectives and CAPA. The same data you work with becomes your evidence towards ISO 9001.
8
topics in the management review
CAPA
correction with effectiveness check
1
shared risk register for QM, KRITIS and NIS2
Why QM systems end up in a binder
"The manual is from 2019."
A QM system nobody uses day to day goes stale between two audits. It only lives if the work itself happens inside it.
"The measure is ticked off."
Ticked off is not effective. Without an effectiveness check, the same nonconformity returns next year.
"We'll dig out the numbers before the audit."
Quality objectives without ongoing measurements are declarations of intent. Only the trend shows whether an objective is on track.
The building blocks — and how they work together.
Processes
Chains with real approval logic
Model and run processes visually: a run only moves on once the responsible step is approved. Deviations are logged instead of bypassed.
Internal audits
A finding becomes a measure
Audit program with year, area, standard reference and auditor. Findings as major or minor nonconformity or improvement potential, each with a deadline — and straight into the action plan as a task.
Management review
Eight topics, one PDF
The annual review by top management with the seven review inputs and the resulting decisions. On completion the report is generated as a PDF — the classic audit evidence.
Quality objectives
Metric, target, trend
Objectives with metric, target value, unit and deadline; measurements recorded continuously. In the end it reads achieved, missed or dropped — and the trend feeds the management review.
CAPA
Effective first, then closed
Every nonconformity carries the full cycle: immediate correction, root cause analysis with 5-why or Ishikawa, corrective action as a task and the effectiveness check with date and result.
Legal register
Which regulations apply to you
Standards, laws and regulations with status and relevance rating — alongside recurring inspections, measuring equipment with calibration status, supplier ratings and customer feedback.
The improvement cycle closes itself.
Triggers come from improvement suggestions, customer feedback, nonconformities and audit findings. Each becomes a measure with an owner, each measure an effectiveness check. What remains goes into the management review — whose decisions become next year's objectives. No step depends on a spreadsheet.
The risk register is shared: when the compliance modules are booked, QM, KRITIS and NIS2 keep their risks in the same register — each entry with its context, filterable per world.
Improvement suggestion, feedback, nonconformity
Trigger
Measure as a task with an owner
Execution
Effectiveness check with date and result
Verification
Management review and new quality objectives
Year-end
The QM year
What a QM year looks like in SpeamCore
Set objectives
Define quality objectives with metric, target and deadline — measurable, not as a statement of intent.
Plan the audit program
Which areas, when, by whom and against which standard.
Work through the year
Inspections and training on schedule, feedback and improvement suggestions recorded continuously, nonconformities worked through CAPA.
Close audits
Turn findings into measures and track them through to effectiveness.
Complete the review
Fill in the eight topics of the management review and file it as a PDF — the decisions become next year's objectives.
Included in the quality management package.
€99.99 / month
per SpeamCore, plus VAT · independent of user count
Compliance module family
One compliance core. One module per regulation.
Desk, evidence file, action plan, incidents and risk register live in the compliance core. Each regulation is added as its own module — you only book what applies to you.
Physical protection of critical facilities: obligation catalog, checks, site walks, reporting clock.
Information security under §30 BSIG, reporting and supply chain — shares desk, incidents and evidence file with KRITIS.
Processes with approvals, internal audits, management review, CAPA and quality objectives.
Information security management system with control catalog and audit preparation.
Digital operational resilience for financial firms and their ICT providers.
Questions we hear often
Does this make us ISO 9001 certified?
No — only a certification body can certify you. The module covers the core requirements and produces the evidence an audit asks for.
Why can't a nonconformity be closed?
Because the effectiveness check is missing. Only with a result and confirmation date is the CAPA cycle complete — which is exactly what prevents repeat failures.
Do we need a separate document management system?
For the manual, procedures and evidence, the document storage in SpeamCore is enough. Controlled documents with release and read receipts come with the compliance modules.
How does this relate to KRITIS and NIS2?
All three share the risk register and document control. A risk is maintained once and shown in each world with its own context.
Can we plan training with it?
Yes — with dates, waiting list and attendance records. For course content, exams and certificates the LMS takes over.
Show us your last audit report.
We map one real finding from it into the system — from the measure through to the effectiveness check. After that you know what the switch means for your QM.