ISO Compliance Suite (Imtithal) — ISO 27001, ISO 9001 and ISO 42001 compliance software
Imtithal (امتثال, Arabic for compliance) is an ISO management-system suite for companies working toward or maintaining certifications such as ISO 9001, 27001 and 42001. One engine serves twenty-three standards, each licensed on its own, with dashboards, a clause tree, clause-by-clause status entry by named owners, gap analysis and a certification roadmap, in English and Arabic. ISO/IEC 27001:2022 comes complete with its sub-clauses and all 93 Annex A controls, a Statement of Applicability you approve and export to Excel, an internal audit programme with audits, findings and corrective actions checked for effectiveness, and a risk register you maintain on screen. Limits today: AI suggestions and automatic evidence collection are not active.
Last updated
No credit card · Ready in about a minute · Your data stays private
Step-by-step guides for every role
29 features in 6 areas · works with 4 other modules · 1 team workflow
Full feature list
Standards portfolio
See where the company stands across every ISO standard it holds.
- Portfolio launcher — One page shows every standard you are licensed for as a tile with its conformity percentage and clause count, grouped by family such as quality, security and AI.For: Compliance director, Management system manager, Compliance executive
- Organisation-wide posture — A header band shows overall conformity, how many standards are certified or being implemented and how many gaps are open.For: Compliance director, Management system manager
- Twenty-three standards in the catalogue — The catalogue covers quality, environment, safety, security and continuity, AI governance, ethics and risk, innovation and asset standards, such as ISO 9001, 14001, 45001, 27001, 27701, 22301, 42001, 31000 and 55001, each sold as its own licence.For: Compliance director, Management system manager
- Licence per standard — You license only the standards you need and the launcher shows only those; the portfolio licence unlocks the cross-standard view. A standard the company has not added stays closed everywhere: its address shows "This standard is not in your plan", every one of its pages and status changes is refused (402) — through an outside AI assistant too — and the portfolio band, approval queue, decision log and compliance agents count only the standards you hold.For: Tenant admin
- Standard-specific clauses — Each standard carries the shared management-system clauses 4 to 10 plus its own, such as ISO 9001 operation clauses, ISO 27001 Annex A control groups and ISO 42001 AI control groups.For: Tenant admin
- English and Arabic with right-to-left — Standard names, clauses and screens are available in English and Arabic.For: Tenant admin
- Dedicated ISO 42001 AI management module — ISO 42001 runs as its own separately deployed module with its own address and licence, ready for AI governance programmes.For: Compliance director, Management system manager
Conformity by clause
Record and track how well each requirement is met.
- Per-standard dashboard — Each standard has a dashboard with its overall conformity, level counts, certification status, next audit date and a conformity breakdown by clause group.For: Compliance director, Management system manager, Compliance executive
- Clause tree with status — Browse the standard's clauses as a tree with a status dot on each, so gaps are visible at a glance.For: Compliance director, Management system manager, Clause owner
- Compliance entry clause by clause — Work through leaf clauses in a queue with progress, choose a level (not assessed, non-compliant, partially compliant, compliant or not applicable), set a score and write the justification, then Save and next.For: Clause owner, Management system manager
- Every status change is audited — Each saved status is written to the audit log and a person confirms it before it counts.For: Compliance director, Management system manager
- Conformity score rule — Conformity counts compliant clauses fully, partially compliant ones as half and leaves out clauses marked not applicable.For: Tenant admin
- Gap analysis — Lists open gaps, partial and not-yet-assessed clauses in priority order with an estimate of weeks to be ready.For: Compliance director, Management system manager
- ISO 27001:2022 in full — The ISO/IEC 27001:2022 clause tree carries its sub-clauses (risk assessment and treatment, documented information, internal audit programme, management review inputs and results) and all 93 Annex A controls under their four themes, with English and Arabic titles. A company that already started keeps every status and finding it recorded when the controls are added.For: Compliance director, Clause owner, Management system manager
- Statement of Applicability — For every Annex A control, decide whether it applies, tick why (risk treatment, legal, regulatory, contractual, business, good practice) or say why it is excluded, record how it is implemented, who owns it and the target date, and see the evidence and risks linked to it. Approve it as a numbered version, see what changed since, and export it to Excel or CSV for the auditor.For: Compliance director, Management system manager, Compliance executive
Evidence, audits and risk
Prove conformity and manage what could go wrong.
- Evidence library — Browse proof items by type, status, collection date and expiry, and add your own: a photo, a file filed in Documents, a written note or a link against a clause. Somebody other than the person who captured it accepts or rejects it, on the version they opened. Changing reviewed evidence sends it back for a new review with the old verdict cleared, and expired evidence stays expired until a new file, link or expiry date renews it.For: Compliance director, Management system manager, Internal auditor
- Audits and findings — Plan an internal audit programme (period, scope, criteria, method, how auditors stay independent) and approve it, then plan each audit with its scope, clauses and controls covered and lead auditor, run it, raise findings (major or minor nonconformity, observation, opportunity for improvement) with the objective evidence seen, and conclude it with a result and conclusion.For: Compliance director, Management system manager, Internal auditor
- Corrective action tracking — Each finding carries its correction, root cause, corrective action, owner and due date, and moves through plan, implement, verify and closed. A nonconformity closes only once someone has checked that the corrective action worked.For: Internal auditor
- Risk register with heat matrix — Register risks numbered R-001 onward with the asset, threat and vulnerability, score likelihood and impact before and after treatment, choose the treatment and its plan, link the Annex A controls that treat it, and record that the risk owner accepted the residual risk. A heat matrix shows where the risks sit.For: Compliance director, Management system manager
- Controlled documents — Keep the register of controlled documents (policies, procedures, plans, registers, records, reports) with code, revision, owner, the clauses each serves, approval and next review date, flagging overdue reviews.For: Compliance director, Management system manager
- Certification roadmap — Shows certification status, the next audit and a timeline of planned and completed assessments.For: Compliance director, Management system manager
Continuous monitoring
An overview of automated compliance helpers and their decisions.
- Agent fleet overview — Shows the compliance helper agents such as evidence collector, drift detector, control tester and gap hunter with their autonomy level (suggests, acts with approval or autonomous). Display only today.For: Compliance director, Management system manager
- Connected systems overview — Lists the systems the monitoring is meant to read from and when each last synced. Display only today.For: Compliance director, Management system manager
- Approval queue view — Shows actions the helpers have proposed that await a person's sign-off.For: Compliance director, Management system manager
- Tamper-evident AI decision log — Every recorded AI decision is chained to the one before it with a fingerprint, so any later change to the history is detectable.For: Internal auditor, Compliance director
Roles and permissions
Give each person only the part of the programme they work on.
- Five ready-made compliance roles — Compliance director, management system manager, internal auditor, clause owner and compliance executive come with the right permissions.For: Tenant admin
- Separate view and write permissions — Reading standards, clauses, evidence, audits, findings, risks and documents are separate from the permission to change a clause status.For: Tenant admin
- Works with Documents and Activities — The suite depends on Documents and Activities, and each separate standard depends on the portfolio licence.For: Tenant admin
Learn it in the app
A guided tour inside Imtithal — ISO Compliance teaches the work by having you do it.
- Hands-on guided tour — 6 short chapters (Your standards at a glance; Assess clause by clause; Prove it with evidence; Audits and findings; Keep the risk register; Documents and certification roadmap) that start by themselves the first time you open Imtithal — ISO Compliance. Each step waits for you to really do it, such as opening a list or saving a first record, and any chapter can be paused, resumed or replayed from the last row of the Imtithal — ISO Compliance menu or from Tours in the account menu.For: Compliance director, Management system manager, Compliance executive, Tenant admin, Clause owner, Internal auditor
Works with other modules
Controlled documents sit beside the document libraryThe suite requires the Documents module; its controlled-document register lists policies and procedures with revision and review dates.Compliance follow-up uses ActivitiesThe suite requires the Activities module, so follow-up tasks live in the same place as the rest of your work.Standards, training and visa files feed the compliance wallOpen items against the standards register, training records, visa files and retention rules are read for one auditor-facing page.Read your compliance position by conversationThe Copilot reads the ISO compliance portfolio, a standard's dashboard, gap analyses, findings and risks for people who hold the compliance permission.
Done by more than one person
What each role gets
- Compliance officer — Compliance officers follow every ISO standard the company holds, including the AI-governance family (ISO 42001, 23894 and 42005), from one portfolio page showing overall conformity, how many standards are certified or being implemented and how many gaps are open. For each standard they read the dashboard, the clause tree, the gap analysis with its estimate of weeks to be ready and the certification roadmap, and record each clause's level, score and justification, with every change written to the audit log. Evidence, audits, findings, corrective actions, risks and controlled documents can be reviewed, but today those records are loaded for them, as demonstration data or by the implementation team, and cannot yet be created on screen.
- Auditor — Auditors review internal, surveillance and certification audits with their findings, and follow each corrective action, with its root cause, through plan, implement, verify and closed on a board, in English or Arabic. Beside them they read the evidence library, with each item's status and expiry. Today these records are loaded for them, as demonstration data or by the implementation team: planning an audit or logging a finding on screen is not yet available, and nothing exports for the auditor yet.
- Control owner — Control owners work through the standard's clauses in a queue with a progress bar: for each they choose a level (not assessed, non-compliant, partially compliant, compliant or not applicable), set a score, write the justification and press Save and next. Each saved status is written to the audit log, and nothing is filled in automatically. The queue covers every clause of the standard rather than a personal list, and they can open the evidence library to see what proof is on file and when it expires, though adding evidence on screen is not yet available.
- Tenant admin — Tenant admins decide which of the twenty-three ISO standards are active for the company, including the AI-governance family (ISO 42001, 23894 and 42005): each is licensed on its own, the launcher shows only those, and the portfolio licence unlocks the cross-standard view. They give each person one of five ready-made compliance roles (compliance director, management system manager, internal auditor, clause owner or compliance executive), in which reading is kept separate from the right to change a clause status. Standard names, clauses and screens are in English and Arabic with right-to-left layout, and nothing exports for the auditor yet.
Frequently asked questions
Which ISO standards are covered?
Twenty-three, including ISO 9001, 14001, 45001, 27001, 27701, 22301, 20000, 22000, 50001, 13485, 37001, 37301, 42001 and other AI governance standards. Each is licensed separately.
Can I prepare for an ISO 27001 or 9001 certification with it?
Yes. ISO 27001:2022 carries all 93 Annex A controls; you decide and approve the Statement of Applicability and export it to Excel, keep the risk register, run an internal audit programme with findings and corrective actions, and track conformity clause by clause with gaps and a roadmap.
Is the AI assistance built in?
Not yet. The screens show where AI suggestions will appear, but nothing is suggested or committed automatically; every status is entered by a person.
Does it support Arabic?
Yes, standards and clauses carry Arabic names and the screens support right-to-left.
Can I connect to our cloud systems for automatic evidence?
Not yet. The monitoring screens are an overview only.
Who can change a clause status?
Only people holding the status-write permission, such as clause owners and management system managers; everyone with read access can view.
Is there an export for the auditor?
Not yet.
Part of one platform
ISO Compliance Suite (Imtithal) is one of 59 apps (36 business apps and 23 ISO standards) that share the same sign-in, the same people, the same customers and the same AI copilot. See all apps or how Tarleaks ERP compares with Odoo, ERPNext and Zoho.