What we shipped, in plain language.

Compliance tasks now carry a full submission and verification track:

• Submit with evidence — the task owner attaches one or more supporting documents and submits the task for review.
• Verification workflow — submission routes through a Compliance Officer approval step; approval marks the task Verified and closes it, while a return sends it back to the owner to re-submit.
• A dedicated worklist makes it easy to see what needs submitting, what is awaiting verification and what has been returned.

The Purchase Order list view now presents amounts more clearly:

• Base, Tax and Total columns — each PO shows a pre-tax base amount, the total tax (line plus header), and the payable grand total, all consistently rounded to two decimal places.
• Correct currency code — the list and detail views now display the proper currency code instead of a blank or incorrect value.

Resolved issues in the Plant Maintenance Defect Analysis and Maintenance Resource forms so they load and save reliably, with matching support added on the server side.

Risks can now be scored and visualised:

• Assessment — rate each risk by likelihood and impact using the shared GRC scoring matrix to derive an inherent risk rating.
• Heat-map — see the whole risk portfolio plotted on a colour-coded likelihood-vs-impact grid to spot the highest-priority risks at a glance.

You can now define and govern how each risk is addressed:

• Treatment plans — choose a strategy (Mitigate, Transfer, Accept or Avoid), set a target residual rating, and break the plan into individual treatment actions with owners.
• Approval workflow — submit a plan for review and it routes through a Risk Manager approval step; approval moves the risk into treatment, while rejection returns it to draft.
• Raise CAPA — turn any treatment action into a formal Corrective & Preventive Action and keep it linked back to the risk.

Risk Management now supports ongoing monitoring so risks don't go stale:

• Periodic reviews — schedule recurring re-assessments (monthly, quarterly and so on) with an outcome and a next-review date; overdue reviews trigger alerts.
• Key Risk Indicators (KRIs) — track metrics against amber/red thresholds, record readings over time, and have each reading automatically classified Green, Amber or Red.
• Breach & overdue notifications — owners, risk owners and Risk Managers are notified in-app and via web push when a KRI breaches its threshold or a review falls overdue.

Coloured status badges in Payroll grids (for example on the Payroll Results screen) showed the colour but no label — the text inherited the dark cell colour and was clipped to zero width. Badges now use their own colour, are no longer clipped, and sit centred in the row, so the status is always readable. The fix applies to every status badge across the application's grids.

Several Payroll configuration and processing screens were tidied up for more reliable behaviour, including Bank File Generations, Employee Tax Configs, Final Settlements, GL Configs, Off-Cycle Payrolls, Payslip Templates, Posting Logs, Tax Declarations and Tax Slabs.

A new GRC Core layer underpins the organisation's governance, risk and compliance capabilities. It provides:

• Shared scoring — a common scoring matrix and service so risks, assessments and controls are rated consistently across modules.
• Source linking — a standard way to connect a risk, control or finding back to the record it originated from anywhere in the system.
• Workflow, CAPA & incident facades — reusable hooks into the Workflow Engine, Corrective & Preventive Actions and incident handling, so each GRC module plugs into approvals and remediation without re-implementing them.

This release lays the groundwork; the Risk Management app is the first module to build on it.

The new Risk Management module gives you a single place to record and govern enterprise risk:

• Risk Register — capture each risk with its owner, description and context, and manage the full list from one workspace.
• Risk taxonomy — organise risks using configurable categories, sources and risk-appetite definitions so they can be grouped and reported consistently.
• Built on the GRC Core foundation, with dedicated Risk Officer, Risk Manager and read-only CRO / Executive Viewer roles.

System administrators can now manage tenant users from a dedicated User Management area (/admin/users) instead of the Django admin:

• Full user CRUD — create, view, edit and deactivate users, set names, email, phone, department and user type, reset passwords, and toggle staff/superuser, force-password-change and MFA opt-in flags. Each user's assigned roles are shown at a glance.
• User preferences — review and adjust a user's preferences and scoped defaults from the same workspace.
• The new screens are linked from the navigation menu and are restricted to system administrators.