Key capabilities

1. KYC & UBO — supplier due-diligence with document tracking, expiry alerts, and an Ultimate Beneficial Owner register with sanctions cross-check.
2. Fuzzy Sanctions Screening — Levenshtein-distance matching against OFAC, EU, UN, and internal blocklists; creates investigation cases on match.
3. Multi-Dimensional Risk Scoring — inherent and residual scores, country risk tiers, escalation matrix, and SLA enforcement.
4. ESG Profiles — EcoVadis, Sedex/SMETA, ISO 14001/45001, CSRD, LkSG, and modern-slavery attestation.
5. ABC / PEP Questionnaire — questionnaire engine with PEP registry and e-attestation; periodic re-validation reminders.
6. Corrective Action Plans (CAP) — milestone tracking, verification steps, overdue detection cron, and manager sign-off closure.
7. Immutable Audit Log — SHA-256 hash-chained event log; write() raises ValidationError unconditionally — no record can be altered.
8. Regulatory Calendar — jurisdiction profiles, impact assessment, daily reminder cron, and overdue escalation.
9. Gifts & Hospitality Register — configurable policy limits; approval workflow triggered above threshold.
10. Conflict of Interest Registry — COI declaration form with automatic recusal enforcement.
11. Contract Clause Library — standard clause templates with price deviation alerts and approval workflow.
12. Dual-Authorization — four-eyes enforcement for exception resolution; bypassing is blocked at ORM level in action_resolve().
13. OWL Compliance Command Center — real-time dashboard: KPI tiles, risk distribution, active cases, upcoming regulatory events, and recent alerts.
14. Three-tier RBAC — Compliance User (read-only) / Compliance Officer (create & edit) / Compliance Manager (full CRUD, exception approval).
15. Multi-company isolation — record rules on all primary models using ['|', ('company_id', '=', False), ('company_id', 'in', company_ids)].

Installation

1. Install the module from :menuselection:`Apps` (search for Purchase Compliance).
2. Ensure the following standard modules are installed:
   • base, purchase, product, mail, uom
3. Assign users to the appropriate security group (see Security groups).
4. Optionally import your sanctions-list entries under :menuselection:`Compliance --> Configuration --> Sanctions Lists`.
5. Configure country risk tiers under :menuselection:`Compliance --> Configuration --> Country Risk`.

Security groups

Groups use implied_ids inheritance: Officer implies User; Manager implies Officer.

Supplier compliance profile

1. Navigate to :menuselection:`Compliance --> Suppliers --> Compliance Profiles`.
2. Click :guilabel:`New`.
3. Select the supplier in the :guilabel:`Partner` field.
4. Complete the profile tabs:
   • KYC — attach KYC documents; set expiry dates; mark :guilabel:`KYC Completed` and :guilabel:`Sanctions Check`.
   • UBO — add Ultimate Beneficial Owner entries; the system cross-checks UBO names against active sanctions lists.
   • ESG — select applicable frameworks (EcoVadis, Sedex, ISO 14001/45001, CSRD, LkSG, modern slavery); attach evidence documents.
   • Risk — inherent and residual risk scores are computed automatically from questionnaire results and country-risk tier.
5. Click :guilabel:`Save`.

Running a sanctions screen

To screen a supplier on demand:

1. Open the supplier's compliance profile.
2. Click :guilabel:`Screen Sanctions` in the action bar.
3. The service grev.purchase.compliance.service.run_sanctions_screening runs a Levenshtein fuzzy match against all active list entries.
4. If a match is found above the configured threshold, an investigation case is created automatically and the officer is notified by Odoo activity.

The weekly batch cron runs the same logic across all active supplier names automatically every Monday at 02:00.

Managing cases

1. Navigate to :menuselection:`Compliance --> Case Management --> Cases`.
2. Cases are created automatically by compliance event checks or sanctions screening. They can also be raised manually.
3. Progress a case through the stages: Open → Investigating → Resolved / Closed.
4. Resolving a case flagged for dual-authorization requires a second approver different from the user who opened or last edited the case.

Corrective Action Plans

1. From an open case, click :guilabel:`Create CAP`.
2. Add milestone lines with target dates.
3. As milestones are completed, mark them :guilabel:`Done`.
4. The daily cron marks CAPs as Overdue when the due date passes with open milestones.
5. The Compliance Manager closes the CAP after verifying all milestones.

Regulatory calendar

1. Navigate to :menuselection:`Compliance --> Regulatory --> Calendar`.
2. Create a regulatory event, selecting the jurisdiction profile and assigning an impact level.
3. The daily reminder cron creates Odoo activities for events due within 30 days.
4. Overdue events are escalated to the Compliance Manager automatically.

ABC questionnaire

1. Navigate to :menuselection:`Compliance --> ABC --> Questionnaires`.
2. Assign a questionnaire to a supplier; the supplier completes it via the portal (if the supplier portal module is installed) or internally.
3. PEP status is declared and stored in the PEP registry.
4. E-attestation timestamp and signatory are captured on submission.

Models

Key service methods

grev.purchase.compliance.service

Scheduled actions (crons)

Performance

• Sanctions screening: Levenshtein computed in Python on cached list entries
• Supports 5,000+ supplier profiles
• 20,000+ compliance documents
• Stored computed fields on compliance_status and compliance_score
• Indexed on partner_id, compliance_status, and company_id