How it all fits together: end-to-end journeys

Interactive tutorial

Follow the course step by step in the interactive player.

Lessons

1. 1Journey A, part 1: Legal uploads the supply contractThis is the first of six journeys that follow one piece of business through every module and person it touches. Journey A follows a new supplier, Najm Al Sahra Fulfilment, from first contact to a paid invoice. It starts with legal counsel uploading the signed supply contract, so that its dates, its obligations and the two parties are on record for everyone who comes next.6 min
2. 2Journey A, part 2: The anti-money-laundering officer checks the screeningWhen legal counsel uploaded the contract, both parties were screened against the sanctions lists without anyone asking. In this part the anti-money-laundering officer finds those two checks, reads how they were cleared, screens the supplier's general manager by hand, and sees where a possible match would land as a task.6 min
3. 3Journey A, part 3: The Data Protection Officer registers the supplier and sends the questionnaireThe supplier will deliver customers' orders, so it will hold their names, addresses and mobile numbers. That makes it a processor of personal data. In this part the Data Protection Officer, or DPO, adds the supplier to the vendor risk register, which also creates its record in the vendor directory that Tax, Finance and Contracts share, and sends it a due diligence questionnaire by secure link.8 min
4. 4Journey A, part 4: The supplier answers the questionnaireThis part is seen from the other side. The supplier's general manager opens the secure link the Data Protection Officer sent, answers the questions, attaches the security certificate and submits. Nobody at the supplier needs a ComplianceOS account. Watch it once so you can tell a supplier what to expect.8 min
5. 5Journey A, part 5: The Data Protection Officer reviews the answersThe supplier has answered. In this part the Data Protection Officer reads the risk score, checks the answers and the certificate, records one gap as a finding with an owner and a due date, and asks a second Data Protection Officer to approve. The preparer cannot approve their own review.7 min
6. 6Journey A, part 6: A second Data Protection Officer approvesComplianceOS binds the preparer and the approver everywhere: the person who prepared a piece of work sees a note, and a second person decides. In this part the second Data Protection Officer finds the request in Approvals, checks the score and the finding, and approves. Approval gives the supplier its risk tier and its next review date.5 min
7. 7Journey A, part 7: Legal links the contract to the supplier's recordWhen the contract was uploaded, the supplier had no record, so Key details said Not linked. The Data Protection Officer has since created the supplier in the vendor directory. In this part legal counsel links the contract to that record, so that the contract, the privacy assessment and the supplier's bills all hang off one supplier, and marks the questionnaire obligation as done.4 min
8. 8Journey A, part 8: The accountant records and verifies the supplier's billThe supplier has sent its first invoice: the September service fee of 80,000 dirhams plus 4,000 dirhams of value added tax, or VAT. In this part the accountant sets up the chart of accounts, because this company is new, enters the bill, and verifies it. Verifying is the moment the bill reaches the ledger and the purchase reaches Tax.8 min
9. 9Journey A, part 9: The accountant pays the bill from the bankThe bill is verified and the transfer has left the bank. In this part the accountant adds the company's bank account, brings in the bank statement, and lets the system match the transfer to the bill. The match is the payment: the bill turns to Paid and the journal entry is posted, without anyone typing the payment in.7 min
10. 10Journey A, part 10: The tax manager finds the purchase in TaxNobody told the tax manager about the bill, and nobody needs to. When the accountant verified it, the purchase arrived in Tax Intelligence with its corporate tax category and its VAT treatment. In this part the tax manager finds it, checks how it was classified, and sees what it does to the VAT position.5 min
11. 11Journey A, recap: What just happened, and where to find it againOne supplier has now passed through six people and six modules. This recap walks back through each module once, as the compliance officer, and points at the record that was left there: the contract, the screening checks, the risk assessment, the paid bill, the tax transaction, the calendar deadline, the sealed evidence and the trail in the audit log.8 min
12. 12Journey B, part 1: The tax manager records a sale and classifies itJourney B follows a sale from the moment it is recorded for tax to a filed VAT return and a closed quarter. The company bills its customers from its own sales system. In this part the tax manager records one sale in Tax Intelligence by hand, has it classified, and approves the AI's suggestion. Sales can also arrive by import; the steps after this one are the same.8 min
13. 13Journey B, part 2: The accountant posts the sale to the ledgerA sale recorded in Tax is one amount for tax purposes; it is not yet in the books. In this part the accountant turns it into a journal entry from Financial Reports and sends it to the finance manager for approval, then categorises the bank fee left from Journey A.7 min
14. 14Journey B, part 3: The finance manager approves the sale entryThe accountant prepared a journal entry for the sale; it is not in the ledger yet. In this part the finance manager finds it in his Approvals inbox, opens it in Accounting, checks it and approves it, and sees the sale arrive in the books as revenue and a receivable.5 min
15. 15Journey B, part 4: The accountant matches the customer's paymentThe sale is in the ledger as money the customer owes. Her transfer has been on the bank statement since 10 October. In this part the accountant matches the bank line to that receivable. The match posts the receipt by itself: the bank goes up and the receivable is cleared.5 min
16. 16Journey B, part 5: The administrator sets who signs off a tax returnBefore the first VAT return is filed, the organisation decides who must sign it. In this part the administrator sets a two-step approval rule for filing a return: the tax manager who prepared it, then a second sign-off from finance. She also gives the finance manager the tax role he needs to open a return. This matters on this system for a practical reason, explained in the first steps.7 min
17. 17Journey B, part 6: The tax manager prepares the VAT return and submits it for sign-offThe quarter from July to September 2026 has ended, and its VAT return is due on 28 October. Everything the return needs is already in Tax: the sale from this journey and the purchase from Journey A. In this part the tax manager checks those rows, sets the company's emirate, agrees the workpaper to the return, computes the return, and submits it for the finance manager's sign-off.9 min
18. 18Journey B, part 7: The finance manager signs off and the return is filedThe return is waiting on its second step. In this part the finance manager finds the request in his Approvals inbox, opens the return, checks the figures, and signs. Between checking and signing, the return is submitted to the Federal Tax Authority on its own portal, which is outside ComplianceOS; the acknowledgement that comes back is attached here. His signature is what files the return in ComplianceOS and locks the quarter.6 min
19. 19Journey B, part 8: The filing deadline completes itselfNobody ticked a box to say the VAT return was filed. Filing it, in part 7, completed the deadline. In this part the tax manager checks the Filing Tracker and finds the locked package with the acknowledgement.4 min
20. 20Journey B, part 9: The finance manager closes the quarter and checks the trial balanceThe VAT return for the quarter is filed. In this part the finance manager closes the accounting period for July to September, so that nothing more can be posted into the quarter, and opens the trial balance to confirm that the ledger still balances after everything Journeys A and B posted.5 min
21. 21Journey B, recap: What just happened, and where to find it againOne sale has passed through Tax, the ledger, the bank, a two-person sign-off and the filing calendar. This recap walks back through each place once, as the compliance officer, and points at what was left there.7 min
22. 22Journey C, part 1: HR registers a new employeeJourney C follows people: a joiner, a monthly payroll, and a leaver. It starts with a new store supervisor, Hessa Al Marri, who joined on 1 September 2026. In this part the HR director registers her. The record is the root of everything that follows: her line in the salary file, the company's Emiratisation ratio, the workforce figures in the sustainability report, and a sanctions check on her name.6 min
23. 23Journey C, part 2: HR records her documents and payment detailsA record is not finished until two things are on it. The first is the employee's identity documents with their expiry dates, so that reminders go out before one runs out. The second is her salary payment details, without which she cannot be in the monthly salary file. In this part the HR director adds both and sees the document appear in the list of those expiring soon.6 min
24. 24Journey C, part 3: HR prepares the salary file and records that it was paidSalaries in the UAE are paid through the Wage Protection System, or WPS. Each month the employer sends its bank a Salary Information File, or SIF, with one line per employee. In this part the HR director sets up the employer's details once, completes the payment details of the other employee, prepares the file for September 2026, and records that the bank paid it on time.9 min
25. 25Journey C, part 4: What the hire and the payroll changed in other modulesHR worked only in Workforce. In this part the compliance officer follows the effects outwards: the Emiratisation ratio, the sanctions check on the new employee, the workforce figures in the sustainability module, known as ESG, which stands for environmental, social and governance, the calendar, and the Evidence Vault. None of these were typed in a second time.6 min
26. 26Journey C, part 5: The Data Protection Officer drafts the privacy policy every employee must readEvery employee handles personal data: customers' addresses, colleagues' salaries. A joiner should read the rules and confirm that she has. In this part the Data Protection Officer drafts the company's acceptable use policy from a starter template and submits it for approval. A second person will approve and publish it, and then send it to all staff.6 min
27. 27Journey C, part 6: A second Data Protection Officer publishes the policy and sends it to all staffThe policy is waiting for approval. In this part the second Data Protection Officer records the legal review, approves the policy, which publishes it, and then launches an attestation campaign: a request to every member of staff to read the policy and confirm that they have. Each person receives it as a task of their own.7 min
28. 28Journey C, part 7: An employee reads the policy and checks her own recordThis part is seen from an employee's side. Aisha Farouk has no compliance role; she has the self-service access every employee can be given. She signs in, finds the policy waiting under My privacy tasks, reads and acknowledges it, and then looks at her own employee record as HR holds it. She also finds out what she cannot open.5 min
29. 29Journey C, part 8: HR records a leaver and the end-of-service gratuityAisha Farouk has resigned after three years. In this part the HR director records her as a leaver. ComplianceOS works out her end-of-service gratuity, the payment UAE labour law gives a departing employee, and posts it to the ledger as an amount owed. When the money has been paid, HR records the payment, which posts a second entry. Nobody writes a journal by hand.7 min
30. 30Journey C, part 9: The administrator removes the leaver's accessRecording a leaver in Workforce does not touch her sign-in. These two are not linked today: HR records that the person has left, and an administrator removes the access. In this part the administrator finds Aisha Farouk in Access control and revokes her role, which ends her access at once and leaves a record of who removed it and when.4 min
31. 31Journey C, part 10: The former employee asks for her data, and the request is assignedA week after leaving, Aisha Farouk e-mails from her personal address to ask for a copy of the personal data the company holds about her. That is a data subject request, or DSR, and the law gives a fixed time to answer. In this part the Data Protection Officer logs the request and assigns it to a colleague, who will find it waiting in My Actions.6 min
32. 32Journey C, part 11: The assigned officer picks the request up from My Actions and answers itThe former employee's request was assigned to Yusuf Rahman. In this part he finds it in My Actions, opens it, records that he checked who she is, marks it in progress, and, once HR has supplied the copy of her records, closes it with a note of what was sent. The request then leaves his list.7 min
33. 33Journey C, recap: What just happened, and where to find it againTwo people passed through this journey: a joiner and a leaver. Between them they touched Workforce, sanctions screening, the salary file, ESG, the calendar, privacy policies, the ledger, access control and data subject requests. This recap visits each place once, as the compliance officer, and also names the two hand-offs that the system does not make for you.7 min
34. 34Journey D, part 1: The Data Protection Officer logs a personal data breachJourney D follows something nobody plans: a personal data incident. The fulfilment supplier from Journey A has phoned, as its contract requires, to say that a courier's handheld device with the day's delivery list has been lost. In this part the Data Protection Officer logs the breach. Logging it starts the clock for telling the regulator, and it is the record that every later step, in this module and in others, hangs from.8 min
35. 35Journey D, part 2: The Data Protection Officer drafts the notices, in English and ArabicA breach can need two notices: one to the regulator and one to the people affected. In this part the Data Protection Officer drafts both from the breach record, completes the regulator's notice, replaces the Arabic half of the customer notice with a proper translation, reads the check that finds any Arabic text still in English, and submits both for approval.9 min
36. 36Journey D, part 3: A second Data Protection Officer approves the noticesNothing leaves the company about a breach on one person's say. In this part the second Data Protection Officer finds both notices in his Approvals inbox, checks the regulator's notice and approves it, and then approves the customer notice, which first requires him to confirm that the Arabic text is complete.6 min
37. 37Journey D, part 4: The notices are delivered and recorded as sentThe notices are approved. ComplianceOS does not file anything with the regulator, and e-mail is switched off on this system, so the Data Protection Officer delivers both notices herself and then records, on each, when and how it was sent. Recording the regulator's notice as sent stops the deadline clock and changes the breach's status.6 min
38. 38Journey D, part 5: The compliance officer finds the breach in the Risk Register and assigns the treatmentA breach is also a risk to the business, and the Risk Register is where all risks are weighed together. In this part the compliance officer brings the register up to date from the other modules, finds the breach there, already scored from its severity, and takes ownership of it with a treatment plan and a due date. It then appears in her own My Actions until the treatment is done.6 min
39. 39Journey D, part 6: The Data Protection Officer re-assesses the supplierThe treatment plan on the breach risk says: re-assess the fulfilment supplier. The compliance officer has asked the Data Protection Officer to do it. In this part she sends the supplier where the breach happened a fresh due diligence questionnaire. Neither the breach nor the risk is linked to the supplier's record by the system, so she makes that connection herself.5 min
40. 40Journey D, part 7: A customer wants her data erased, and the public portal is not availableOne of the customers who received the breach notice no longer wants the company to hold her data. The usual route is the public request portal, where a person confirms a request with a code sent by e-mail. E-mail is not set up on this training system, so the portal cannot be switched on. In this short part the Data Protection Officer sees why, and what to do instead.3 min
41. 41Journey D, part 8: The Data Protection Officer logs the erasure request and prepares the planThe customer has telephoned to say she asked for her data to be deleted. In this part the Data Protection Officer logs the erasure request by hand, searches for the customer's records, builds an erasure plan from the search, runs a dry-run that changes nothing, and submits the plan for approval. Erasure never happens on one person's decision.8 min
42. 42Journey D, part 9: A second officer approves and carries out the erasureThe erasure plan is waiting for a second person. In this part the second Data Protection Officer approves it, executes it by typing the plan's reference, reads the letter that tells the customer what was erased and what was kept and why, closes the request, and finds the customer on the suppression list, which stops her data being collected again.9 min
43. 43Journey D, part 10: The compliance officer produces the report for the board, and schedules itThe board will ask what happened and where the company stands. In this part the compliance officer requests a Full Compliance Report, which draws on every module, including the breach, the supplier, the tax return and the workforce figures from the earlier journeys. She then schedules the same report to be produced every month, so the board gets it without anyone remembering.6 min
44. 44Journey D, recap: What just happened, and where to find it againOne lost device led to a breach record, two approved notices, a risk with an owner, a supplier re-assessment, an erasure and a report. This recap visits each place once, as the compliance officer, and names the hand-offs that people, not the system, had to make.7 min
45. 45Journey E, part 1: The compliance officer starts an audit and uploads the checklistJourney E looks at the earlier journeys from the outside: an audit. The compliance officer runs an internal review of the third quarter that tests three things you have already seen happen: the September salaries, the VAT return and the breach notification. In this part she starts the audit in the Audit Hub and uploads two documents, the control standard and her checklist, for the system to turn into requests for evidence.6 min
46. 46Journey E, part 2: The compliance officer reviews the mapping and assigns the requestsThe system has read the standard and the checklist. In this part the compliance officer reviews what it produced, confirms it, and assigns each request for evidence to the person who holds the proof: payroll to the HR director, the VAT return to the finance manager, the breach to the Data Protection Officer. Dispatching puts each request in that person's own list.8 min
47. 47Journey E, part 3: The HR director answers the audit requestIn Journey C you prepared the salary file and recorded the day the bank paid it. The audit now asks you to prove it. In this part you find the request in My audit requests, explain how the requirement was met, attach the proof as a PDF, and submit. An automatic check reads your answer and the file and scores it before the compliance officer sees it.5 min
48. 48Journey E, part 4: The finance manager answers the audit requestIn Journey B you gave the second sign-off that filed the return, and attached the acknowledgement. The audit now asks for that proof. In this part you find the request in My audit requests, explain how the requirement was met, attach the proof as a PDF, and submit. An automatic check reads your answer and the file and scores it before the compliance officer sees it.5 min
49. 49Journey E, part 5: The Data Protection Officer answers the audit requestIn Journey D you logged the breach and recorded when the regulator was told. The audit now asks you to prove it. In this part you find the request in My audit requests, explain how the requirement was met, attach the proof as an image, and submit. An automatic check reads your answer and the file and scores it before the compliance officer sees it.5 min
50. 50Journey E, part 6: The compliance officer validates the answers and raises a findingThree people have answered. In this part the compliance officer reads each answer with its proof and the automatic check's opinion, adds what the platform itself already knows, accepts the answers that stand, and records one weakness as a finding with an owner and a date. Accepting an answer seals its proof in the Evidence Vault.8 min
51. 51Journey E, part 7: The compliance officer invites the external auditor to this audit onlyThe company's external auditor wants to see how the internal review was done. He should see this one audit and its evidence, and nothing else in the company. In this part the compliance officer invites him to the audit for a limited number of days and takes the invitation as a link, because e-mail is switched off, to send to him herself.5 min
52. 52Journey E, part 8: The external auditor opens the linkThis part is seen from the other side. Graham Whitlock, the external auditor, opens the link he was sent. He has no ComplianceOS account. He reads the audit and its checklist, downloads a sealed evidence record, and submits a finding of his own. Watch it once so you know exactly what an auditor can and cannot see.6 min
53. 53Journey E, part 9: The HR director fixes the finding and marks it resolvedThe compliance officer raised a finding and made the HR director its owner. He cannot open the Audit Hub, and he does not need to. In this part he finds the finding in My Actions, records what was done about it, and marks it resolved. Closing it stays with the people who run the audit.4 min
54. 54Journey E, part 10: The compliance officer closes the finding, completes the audit and downloads the evidence packThe HR director has recorded the fix and marked the finding resolved. In this part the compliance officer checks it and closes it, downloads the evidence pack, which holds every sealed proof of the audit in one file, and completes the audit. Completing takes a final snapshot of the readiness score.6 min
55. 55Journey E, recap: What just happened, and where to find it againOne audit drew on three earlier journeys, four people inside the company and one outside it. This recap visits each place once: the completed audit, the sealed evidence, the trail in the audit log, and the lists that are now empty because the work is done.5 min
56. 56Journey F, part 1: The administrator builds the group's structureThe last journey is about running the group: who sits where, who may do what, and who watches. It starts with structure. The group has two companies, both under Head office. In this part the administrator adds a level called Region, creates a region for the online business, and moves the e-commerce company into it. From then on, a role granted on the region covers the companies inside it.6 min
57. 57Journey F, part 2: The administrator invites people and grants scoped rolesTwo people join. Hana Qasim will run compliance for the online region, and should also administer access inside it. Tariq Haddad is a contractor who needs to look at the e-commerce company for a few weeks. In this part the administrator invites both, gives the contractor a read-only role on one company, and requests a privileged role for the regional manager, which waits for a second administrator.8 min
58. 58Journey F, part 3: The second administrator approves the privileged roleA role that lets someone manage access is never given on one person's decision. In this part the second administrator finds the request in his Approvals inbox, reads who is to get which role, where and why, and approves it. The role is granted the moment he does.4 min
59. 59Journey F, part 4: The administrator sets an approval rule and what each company's score countsTwo settings decide how the group is governed and how it is measured. An approval rule says who must sign what, and how quickly. The score basis says which modules count toward each company's compliance score. In this part the administrator gives journal approvals a time limit, and switches on the modules that apply to the e-commerce company, so that its score is no longer blank.6 min
60. 60Journey F, part 5: A compliance officer sees the group view for her own companies onlyThe group view is not only for head office. A compliance officer whose role covers one company, or one country's companies, can open the same screen and see exactly those. In this part the compliance officer of Meridian Souq Trading opens Group Compliance and reads what it tells her, and what it says it is leaving out.4 min
61. 61Journey F, part 6: The administrator sees the whole groupThe administrator's role covers the whole organisation. In this part she opens the same Group Compliance screen and sees both companies, reads the risk matrix across the group, looks at the organisation's risk register, checks her approvals inbox, and opens the audit log, which for her holds every action in every company.6 min
62. 62Journey F, part 7: The administrator runs an access review and revokes one accessAccess that was right when it was granted goes stale. An access review lists every role in a chosen part of the organisation, so that a reviewer keeps or revokes each one, on the record. In this part the administrator reviews the online region, keeps the regional manager's roles, and revokes the contractor's, whose work has ended.7 min
63. 63Journey F, recap: What just happened, and where to find it againThe last recap, and the end of the course. The administrator walks back through what running the group left behind: the structure, the people and their roles, the rules, the review. It ends with the one screen that ties all six journeys together.5 min

How this connects to the rest of ComplianceOS

• Journey A: a new supplier, from contract to paid invoice

  Uploading a contract screens its parties against the sanctions lists and puts its dated obligations in the calendar. The vendor added in Data Protection is the same vendor directory record that Tax lists and the contract links to. Verifying the supplier's bill posts the journal entry and creates the purchase in Tax; matching the bank line pays the bill. Records are sealed in the Evidence Vault and every step is in the audit log.

• Journey B: a customer sale, from tax record to filed VAT return

  A sale recorded and classified in Tax is posted to the ledger from Financial Reports, as a journal entry that a second person approves. The customer's payment is recorded against the receivable. The VAT return is computed from the approved classified transactions, agreed to its workpaper, signed by two people under the approval policy, and locked with the acknowledgement; that completes the deadline in the Filing Tracker and the calendar.

• Journey C: an employee, from hire to leaver

  Registering an employee screens the name, moves the Emiratisation ratio, fills the workforce figures in ESG and puts document expiry dates in the calendar. The salary file's paid date drives WPS compliance. A published policy reaches each person as a privacy task. Recording a leaver posts the gratuity; paying it posts the bank entry. Removing the leaver's access, and linking a data subject request to the employee record, are steps people take: the modules are not linked.

• Journey D: a personal data incident, from discovery to closure

  A logged breach starts the regulator's clock; its notices are drafted in English and Arabic, approved by a second person and recorded as sent. Sync Modules brings the breach into the Risk Register, scored from its severity, and its owner sees the treatment in My Actions. An erasure request is searched, planned, approved by a second person and executed, and adds the person to the suppression list. Re-assessing the supplier involved is a step a person takes.

• Journey E: an audit, from kickoff to close

  The Audit Hub turns a standard and a checklist into requests for evidence, assigned to anyone with access to the company. Each person answers from My audit requests, which also appear in My Actions, and attaches the proof produced in the earlier journeys. Accepted proofs are sealed in the Evidence Vault and gathered in the evidence pack; an external auditor is invited to that one audit by link.

• Journey F: running the group

  Roles are granted on a unit, a company or the whole organisation, and privileged roles wait for a second administrator in Approvals. Approval policies decide who signs what in every module. The modules switched on for a company decide its score, and Group Compliance shows each reader the companies their role covers. An access review keeps or revokes each grant, on the record.