Guides by role
Management guide
Read the state of the programme in ten minutes, prepare the management review and know what to ask.
Role: Management There is no separate "Management" role: you are a Reader (the default access of anyone who can open the app), and an Approver if you were named to approve policies, a statement or a risk acceptance. A reader reads everything except the audit log, people files and settings. If the administrator chose "Contributor" as the default access, a person with no role no longer reads the registers: ask them for the Reader role.
Ten minutes a month
- Home: readiness, its trend, the action plan, risks, audits and access reviews.
- Frameworks: the readiness of each active framework, and the evidence still to provide.
- Risks: the heat map, risks above appetite, those awaiting acceptance.
- Incidents: open, to handle, lessons to write.
The management review
The Audits screen prepares the clause 9.3 agenda: "Inputs" pre-filled with the year's figures (audits, findings, overdue actions, risks, monitoring) and "Decisions expected". Export it as text or CSV for the meeting. The "To be brought by management" items stay yours.
Good to know
The management review is not recorded in the app: the export is meeting material. Record your decisions in your minutes.
Good questions to ask
- Which controls are "Test failing" or "Evidence to provide", and who answers for them?
- Which risks are accepted above appetite, by whom, until when?
- When did the last internal audit finish? (the auditor expects at least one audit every 365 days)
- When was the last access review?
What the app does not do
- It does not say the organization is compliant or certifiable: readiness describes the state of your controls, evidence and tests.
- It does not replace management's decision or its minutes.
- It sends no automatic report: Reports is generated on demand.
Was this page helpful?