Materiality

Two things put a client's compliance back in question: a change in their processing (a new data source, more data, a new third party — flagged from their re-assessment), or a new mandate you publish that applies to them. The engine proposes a classification from the ruleset; you make the call. Material opens a re-audit and moves any live certificate to Under review; minor is logged.