Guides by role
Approver guide
Approve a policy, a statement, an AI system, a risk or an access review with full knowledge, and leave a trace.
Role: Approver You read everything a reader reads and you approve in five domains: the statement of applicability, policies, AI systems, risks and access reviews. You change nothing: you decide.
What is waiting for you
| Object | What you check before approving | Screen |
|---|---|---|
| Policy | The text, the audience, the review interval; who wrote it | Policies |
| Statement of applicability | The justifications for exclusions, the references of implemented controls | Statement of applicability |
| AI system | The classification and its reasons, the impact assessment | AI governance |
| Risk | The target residual level, the acceptance and its justification | Risks |
| Access review | The "Keep" and "Remove" decisions in your scope | Access reviews |
Approving, step by step
- Open the object from its screen. Read it all: approval seals the version (number, approver, date and a fingerprint of the text for a policy).
- If something is missing, send it back to draft instead of approving "with reservations".
- Approve. The action is recorded in the audit log.
Separation of duties
The rule in the app's core is that you do not approve what you wrote. The server applies it to the statement of applicability, to policies (not the owner nor the person who submitted) to AI systems (the designated approver is never the owner) and to risk acceptance (the owner of a risk does not accept it). Only an administrator can override, and the gap is recorded.
Good to know
A policy can be submitted only if an approver is named: if you expect a request, check with the policy owner that you were named.
What the app does not do
- It does not tell you whether what you approve complies with a standard or the law: it keeps the text, the approval and the acknowledgements.
- It does not e-mail you an approval request: open the relevant screen.
- It does not let you edit: to correct, send it back to the author.
Was this page helpful?