Build your compliance management system.
Keep obligations, evidence requests and remediation work connected to their owners.
How to build your compliance management system
Describe the job
Keep obligations, evidence requests and remediation work connected to their owners.
Review the first version
Choose how the control owner records the obligation source and how the evidence reviewer reviews the next step.
Refine the views
Ask First to adjust the fields and views for the people who will use the app.
Test before sharing
Walk through the process with a sample record and check who owns the next action.
A compliance management system example
A control is labelled complete without its required evidence reference.
Compliance management system example
- Record
- Compliance management system · 01
- Owner
- Control owner
Current stage · Control owner
Open the obligation source
A control is labelled complete without its required evidence reference.
Read the full walkthrough
Open the obligation source
A control is labelled complete without its required evidence reference.
- Record:
- Compliance management system · 01
- Owner:
- Control owner
Review the remediation
Keep its assurance status unverified while assigning follow-up.
- Stage:
- Review pending
- Owner:
- Evidence reviewer
Leave the control unverified
Leave the control unverified until the required evidence has been reviewed.
- Next action:
- Leave the control unverified until the required evidence has been reviewed.
- Owner:
- Compliance coordinator
What to include in your compliance management system
Keep the obligation source in context
Keep obligation source, control owner, evidence request, review date, gap and remediation together so the next person can understand the request or record.
When the next step needs a decision
A control is labelled complete without its required evidence reference. Keep its assurance status unverified while assigning follow-up.
Keep remediation visible
Leave the control unverified until the required evidence has been reviewed.
Choose what each person needs
Give the control owner a working view and the evidence reviewer a review view. Keep obligation source and control owner attached to the decision as the work moves between them.
Questions about compliance management system
Start with obligation source, control owner, evidence request, review date, gap and remediation. Describe who enters the information and who reviews the next step.