Context of the organization (COTO)

COTO records who your management system serves and what could push it off course. It covers three registers required by ISO clauses 4.1, 4.2, and 6.1: interested parties (who matters and what they expect), internal and external issues (concerns raised around those parties), and opportunities scored by probability times benefit. Issues that need action can be ported straight into the risk register or the opportunity register. The page is at /coto, under Context (COTO) in the side nav.

Before you start

• The Context (COTO) module must be enabled. It is on by default. If Context (COTO) is missing from the side nav, an admin can turn it on in Settings > Modules (Governance, risk and compliance group).
• Any member of the organization can open the page and edit all three registers. No admin role is required by the UI.
• To port issues into the risk register, the Risk Register module should also be enabled so you can open the ported risks (see Risks).

The page has three tabs: Interested Parties, Issues, and Opportunity Register. The button in the header changes with the tab: Add Party, Add Issue, or Add Opportunity.

Add interested parties

Start here. Parties are the people and bodies whose needs shape the management system: customers, regulators, certification bodies, staff, neighbors.

1. Open Context (COTO) and stay on the Interested Parties tab.
2. Click Add Party.
3. Fill Name (required), for example "Certification Body" or "Customers".
4. Pick Internal / External.
5. Optionally fill Reason for inclusion (why this party matters to the IMS).
6. Optionally fill Needs & expectations (what the party requires from the organization).
7. Click Add party.

Each party card shows its Internal or External tag and how many issues reference it. Use the pencil icon to edit and the delete icon to deactivate a party.

Log issues

Issues are the concerns and requirements you identify around the context: a new regulation, a supply constraint, a market opening.

1. Switch to the Issues tab and click Add Issue.
2. Fill Issue, concern or requirement (required).
3. Optionally link an Interested party.
4. Pick the Type: Internal or External.
5. Pick the Bias: Risk (the issue threatens you), Opportunity (it could benefit you), or Mixed (both).
6. Pick the Treatment:
   • Add to register: the issue should become an entry in the risk register, the opportunity register, or both, depending on its bias.
   • Monitor: keep watching, no register entry.
   • Other: handled some other way.
7. Optionally add Notes.
8. Click Add issue.

Issue statuses are Open, Ported, and Closed. Each row shows tags for its party, type, bias, and treatment.

Port an issue into a register

When an issue has Treatment Add to register and has not been ported yet, a port button appears on its row. The label depends on the bias:

• Bias Risk: Port to risk register.
• Bias Opportunity: Port to opportunity register.
• Bias Mixed: Port to both registers.

Click it. CompStack then:

1. Creates the register entry (or entries) using the issue's description as the title and description. A ported risk is created with default scoring; open it in Risks to assign an owner and set likelihood and impact. The risk's cause field records that it came from a COTO issue and names the interested party if one was linked.
2. Marks the issue Ported and links it to what was created. The row now shows a green "Ported" tag plus "In risk register" and/or "In opportunity register" tags, and the port button disappears.

Build the opportunity register

Opportunities can be ported from issues or added directly.

1. Switch to the Opportunity Register tab and click Add Opportunity.
2. Fill Title (required) and optionally Description.
3. Pick Probability (1-5) and Benefit (1-5). Both default to 3.
4. Watch the Opportunity factor: probability times benefit, from 1 to 25. When the factor is 5 or more, the dialog adds "pursuit plan suggested".
5. Fill the Pursuit plan describing how the opportunity will be pursued (recommended whenever the factor is 5 or more).
6. Pick the Status: Identified (default), Pursuing, Realized, or Abandoned.
7. Once evaluated, pick the Outcome: Failed, Abandoned, Met some expectations, Met all expectations, or Exceeded expectations. Until then leave it as Not evaluated.
8. Click Add opportunity.

Each row shows the factor in a badge, a "P x B" tag, the status, the outcome once set, a purple "From COTO issue" tag when it was ported, and a "Pursuit plan suggested" tag when the factor is 5 or more but no plan has been written.

Try it

• Add a party "Certification Body", External, with a reason and expectations. Expected: a card with a teal External tag.
• Add an issue "New data protection regulation takes effect next year", External, Bias Risk, Treatment Add to register, linked to the party. Expected: the row shows the party tag, "Bias: Risk", "Add to register", and a Port to risk register button.
• Click Port to risk register. Expected: message "Issue added to register"; the row gains green "Ported" and red "In risk register" tags and the button disappears.
• Open Risks. Expected: a new risk with the issue's text as its title, ready for scoring.
• Add an issue with Bias Mixed and Treatment Add to register, then click Port to both registers. Expected: the row gains both "In risk register" and "In opportunity register" tags, and a matching entry appears in the Opportunity Register tab with a "From COTO issue" tag.
• Add an issue with Treatment Monitor. Expected: no port button appears.
• Add an opportunity with Probability 2 and Benefit 2. Expected: "Opportunity factor: 4" and no pursuit suggestion.
• Change Probability to 3. Expected: "Opportunity factor: 6" with "pursuit plan suggested", and after saving without a plan, a magenta "Pursuit plan suggested" tag on the row.
• Edit the opportunity, set Status Realized and Outcome Met all expectations. Expected: the row shows a blue Realized tag and a green outcome tag.
• On the Parties tab, check the party you linked. Expected: its card shows an issue count tag.

If something goes wrong

• Context (COTO) is missing from the side nav. The module is switched off. An admin can enable Context (COTO) in Settings > Modules.
• Empty states. "No interested parties yet", "No issues logged yet", and "No opportunities yet" just mean nothing has been added; use the Add button in the header.
• The save button does nothing. The required field is empty: Name for parties, the issue description for issues, Title for opportunities.
• No port button on an issue. Either the Treatment is not "Add to register", or the issue has already been ported for its bias. Edit the issue and check the Treatment and Bias.
• Port fails with an error. Porting to the risk register creates a risk, so it needs the risk tables to be reachable; retry, and check that the Risk Register module is enabled if the ported risk is not visible.
• The ported risk looks incomplete. That is expected: the risk is created with default scoring for the owner to refine. Open it in Risks and score likelihood and impact.
• The opportunity factor did not change after editing P or B. The factor is computed by the database when the row is saved; save the dialog and the list will show the updated badge.
• A save fails with a permission error. Your session may have expired or your membership is inactive. Sign in again or ask an admin to check your membership in Settings.