Compliance
Templates for 15 standards and regulations, plus compliance risks, reports and audits in one single system.
The starting point
Rules rarely come alone
Alongside the standard there are laws, official requirements and the demands of your customers. Each rule brings its own lists, deadlines and evidence. Whoever keeps them in separate spreadsheets loses the overview exactly where it is needed: in the audit.
In SpiceQMS, one management system carries several standards in parallel, such as ISO 9001 and ISO 14001. Compliance audits, compliance risks and compliance reports sit in the same system as your processes.
So you see in one place what applies, what is open and what is proven. A second list beside the system becomes unnecessary.
Templates for 15 standards
Quality
Environment and energy
ISO 14001, ISO 50001 and the EMAS regulation of the European Union.
Safety and security
ISO 45001 for safety at work and ISO 27001 for information security.
Laboratories and inspection
ISO/IEC 17025, also in its 2005 version, ISO/IEC 17020 and ISO 15189.
Compliance
ISO 37301 for compliance management and ISO 37001 against bribery.
Road safety
Safety assessment of road infrastructure.
Chapter structures, ready for your content
Almost 1,500 chapter templates follow the structure of each standard, and audit questions can be stored for every chapter.
Cybersecurity
Cybersecurity must now be proven
Since 1 October 2026, the NISG 2026 has implemented Directive (EU) 2022/2555, known as NIS2, in Austria. As a rule, it covers entities in critical sectors from medium company size upwards. Through the supply chain, the requirements also reach smaller businesses.
The act requires appropriate risk management measures in ten areas. Management must ensure and oversee implementation and take part in training itself. Significant security incidents go to the competent CSIRT as an early warning within 24 hours. The self-declaration follows within twelve months after the registration obligation arises.
No software makes a company NIS2-compliant, but it can show where it stands. For ISO 27001, SpiceQMS brings a template with 50 chapters. Many of the required measures are reflected in it. You add the requirements of the NISG 2026 as a separate set of rules through the template structure. Training records for management and staff come from SpiceHCM.
What the act requires in detail is explained in our article on NIS2 in Austria.
Reports and checks with their own process
Compliance reports have their own numbering and run from new through processing and closure to dispatch. Every change is tracked, so the path of a report stays traceable. Customer identification checks run as processes of their own with related tasks. Both can be steered through workflows, so that no deadline depends on a single person.
- Reports with their own numbering
- Change history for every report
- Customer identification with its own tasks
Reports
A channel for concerns
Whoever notices a breach should be able to report it without first searching for the right mailbox. Concerns come in through a Spice interface or your own interface, straight into the management system.
Reports are confidential, without a name on request. Each report gets a number and follows a fixed process until it is closed. Changes are tracked and remain traceable later.
That way a concern reaches the place that has to handle it, and it does not sit there unattended.
Compliance risks in view, audits on schedule
Compliance risk is a risk class of its own, rated by impact and likelihood. From this, SpiceQMS calculates a risk value and rates it as low, medium or high. Risk assessments are records of their own with an approval step, and their history is kept. Compliance audits run alongside system, process and product audits. A dashboard for risks and compliance shows management where rules are most likely to be broken.
- Compliance risk as its own class
- Compliance audits
- Dashboard for risks and compliance
What changes
Evidence instead of searching
When the audit asks, the answer is in the system, with its history. Every finding stays linked to its audit and the exact report item. From assessment to the effectiveness check, every step is documented.
With SpiceHCM, training evidence comes from the same people data. Output templates list processes with their risks and chapters of the standard, for example for the management review.
Preparing for an audit thus shrinks to what matters. Tell us which rules your organisation has to meet.
Questions about compliance
The templates follow the chapter structure of each standard. Audit questions can be stored for every chapter.
Yes, new standards are added through the template structure.
Through a Spice interface or your own interface, directly into the management system.
Yes, from assessment through implementation to the effectiveness check.
Only if you set up Spice AI, which is included in SpiceQMS Standard. Without a registered interface, Spice AI is not active. Spice AI works only within your permissions and with the service you connect yourself. Reports and compliance notifications stay closed to Spice AI, even when an interface is registered.
Hosting is all in the EU, on request all in Austria with European operators.
Talk to us.
What are you planning, and what is missing today? We reply personally and tell you plainly whether Spice is the right fit.
- You tell us what you have in mind.
- We get back to you personally by email.
- If you like, we show you Spice in a demonstration.
Prefer to talk directly? office@spicecrm.com+43 (1) 89083610