Approvals, evidence and the audit trail

Interactive tutorial

Follow the course step by step in the interactive player.

Lessons

1. 1Send a privacy policy for approvalThis lesson is for anyone who prepares records. You will look at an empty Approvals inbox, write a privacy policy as a draft, fill in every field, and send it to a second person for approval.7 min
2. 2Send a second kind of record for approval: a DPIAThis lesson is for anyone who prepares records. You will create a data protection impact assessment, or DPIA, answer its questions, attach a supporting file, and submit it. It goes to the same Approvals inbox as the privacy policy, which shows that every kind of record follows the same route.8 min
3. 3Track your requests, withdraw one and send it againThis lesson is for anyone who has sent a record for approval. You will read a request card, filter your requests by status and by type, withdraw a request you sent too early, correct the record and submit it again.6 min
4. 4Work through your inbox and reject a requestThis lesson is for approvers. As the second person, you will read the To decide tab, filter it by type of approval, open the record behind a request, and send it back with a clear reason because it is not ready.6 min
5. 5Fix a rejected record and send it againThis lesson is for preparers. You will find a request that was rejected, read the approver's reason, correct the record, say what changed, and submit it again.5 min
6. 6Approve a requestThis lesson is for approvers. You will open a request that came back after a rejection, check that the correction was made, approve it with a comment, and see the record change state.5 min
7. 7See the outcome and the approval historyThis lesson is for preparers. You will confirm that your request was approved, read who approved it and what they wrote, look back over the whole history of the record, and open the published version.4 min
8. 8Delegate your approvals while you are awayThis lesson is for approvers. Before going on leave you will hand your approvals to a named deputy for a set period, so requests do not wait for your return. You do not need to be an administrator to delegate your own work.5 min
9. 9Decide a request as a deputyThis lesson is for anyone who covers for a colleague. As a deputy you will find the requests that the delegation has brought into your inbox, review a data protection impact assessment, approve it, and read the approval history on the record.6 min
10. 10Approval policies at a glanceThis lesson is for administrators and for anyone who wants to know where the approval rules come from. You will open the list of actions that need approval in every module, read the default rule for one of them, and see a rule the organisation has saved. Nothing is changed in this lesson; changing a policy is covered in the course on policies and connectors.5 min
11. 11Upload evidence to the Evidence VaultThis lesson is for compliance officers and anyone who keeps proof of what was done. You will read the Evidence Vault, upload a photograph and link it to a record, upload a certificate with no linked record, and choose how long each file must be kept.7 min
12. 12Find evidence and prove it has not changedThis lesson is for compliance officers. You will find evidence by name, by source type, by retention and by date, group the list by module, open a record, check that the file is unchanged, read who handled it, and attach the original document to a record the system created.8 min
13. 13Share evidence, export an audit pack and check retentionThis lesson is for compliance officers. You will give an outside party one file through a link that expires, see what they see, read the download in the handling history, check every fingerprint in the vault at once, read the retention report, and download an audit pack of everything that matches your filters.8 min
14. 14What a read-only auditor can doThis lesson is for auditors and for the people who work with them. Signed in with the read-only Auditor role, you will check a file's integrity yourself, read its handling history, download an audit pack, and see what the product tells you when a decision is not yours to make.6 min
15. 15Keep working documents in the Document LibraryThis lesson is for anyone who keeps working documents. You will upload a document with a title, description, category, tags and folder, find it again, comment on it, seal it so that it cannot be changed, and remove a document uploaded by mistake.8 min
16. 16Comment on a document with read-only accessThis lesson is for auditors, reviewers and anyone with view-only access. You will open a document in the library, read a colleague's comment, add your own, correct it, and delete a comment you posted by mistake.5 min
17. 17Read the audit logThis lesson is for the people who may read the audit log: auditors, compliance officers, security administrators and people with full access. You will open the log, read its columns, search by action, filter by the kind of record, follow the story of one record, and open the details of an entry.6 min
18. 18The audit log across the whole organisationThis lesson is for administrators with organisation-wide access. You will see how your audit log differs from that of a person whose role covers one entity: it has an entity filter, and it includes events that belong to the organisation rather than to an entity, such as a delegation.4 min
19. 19What you see without the permissionThis lesson is for everyone, and for administrators who want to know what a colleague without access experiences. Signed in as an employee with the self-service role, you will see which parts of this course are missing from the menu, what the Approvals inbox looks like when nothing is yours to decide, and the message shown when you try to open the audit log.4 min
20. 20How this connects: one record from inbox to audit logThis closing lesson is for everyone. You will follow one record through every part of this course. The CCTV assessment was submitted in lesson 2 and has waited in the inbox since. As the compliance officer you will decide it, then watch what the decision creates: tracked actions on the record, a sealed record in the Evidence Vault beside the files attached earlier, and entries in the audit log.8 min

How this connects to the rest of ComplianceOS

• Data Protection

  Submitting a privacy policy or a data protection impact assessment opens a request in the Approvals inbox of everyone who can decide it. The decision made there changes the record: the policy is published, the assessment is approved and its measures become risk actions.

• Every module with a sign-off

  Settings, Access control, Approval policies lists the actions that go through the same inbox: data protection assessments, policies, transfers, vendor assessments and breach notices, journal entries, tax returns, contract drafts, transfer pricing documents, sustainability reports, access changes, compliance tasks and compliance-task waivers, bill-payment reversals, excise returns and Audit Hub answers. By default each needs one approver who did not prepare the record.

• Access control

  A delegation created under Access control brings the delegator's requests into the deputy's Approvals inbox for a set period. The deputy decides under their own name, and the decision records whom they acted for.

• Evidence Vault

  Approving a data protection impact assessment stores a sealed record of the approval in the vault, and a file attached to a question in the assessment is stored there too, both under the source type PDPL DPIA. Evidence you upload yourself can be linked to the record it supports.

• Auditors

  A person with the read-only Auditor role can open the vault, verify a file's integrity, read its handling history and download an audit pack, and can comment on library documents. Someone outside the organisation is given a single file through a share link that expires.

• Audit log

  Creating, editing, submitting, rejecting, approving and publishing records, uploads, integrity checks, share links and exports in the vault, document uploads and comments, and delegations are written to the audit log with the name of the person and the time. The log is open to auditors, compliance officers, security administrators and people with full access.