Guides by role
Compliance manager guide
Run the programme: assessment, action plan, evidence, audits, reviews. A typical week and what needs your decision.
Role: Compliance manager You run the programme. The role gives the right to manage every domain of the app (statement of applicability, controls, risks, vendors, policies, registers, people, access reviews, audits, incidents, AI, tests, frameworks, audit log), except settings and role management, which stay with the administrator.
Your typical week
| When | What you do | Screens |
|---|---|---|
| Monday | Read the overall state, spot what is late | Home, Action plan |
| Ongoing | Add evidence, re-run the assessment after a change | Evidence, Assessment |
| Every month | Review risks, vendors to assess, incidents to handle | Risks, Vendors, Incidents |
| Every quarter | Run an access review | Access reviews |
| Every year | Internal audit programme, management review, audit pack | Audits, Audit pack |
What needs your decision
- Which frameworks to turn on. Standard edition: one at a time; Advanced: several. See Frameworks.
- Applicable or excluded, control by control, with a justification: Statement of applicability.
- Accept a risk or treat it: Risks.
- Name the approvers of policies and AI systems: without a named approver, a policy cannot be submitted.
- What you measure continuously and e-mail reminders: Tests and continuous monitoring.
Delegating
You can give a domain to a domain manager (risks and assets, policies, people and vendors, access reviews, incidents, AI) instead of a second compliance manager. Each domain manager reads everything else and manages their own domain only. The administrator grants it, in Settings › Access. See Roles.
Playbooks you run
ISO 27001 · SOC 2 · DORA · NIS2 · AI Act · Access review · Internal audit · Incident · Policy lifecycle
What the app does not do
- It never says your organization "is compliant": it computes a readiness from your controls, evidence and tests.
- It replaces neither a lawyer, nor an auditor, nor your own judgement on applicability.
- It does not change your Jira access, does not notify authorities, and sends no data out of Jira.
- It does not manage roles: the administrator does.
Was this page helpful?