Reviews capture formal sign-off on controls, policies, and documents. Each review is requested, assigned to a reviewer, and either approved or sent back for changes. Open the Reviews page from admin sidebar → Governance → Reviews.
Reviews live at sidebar → Governance → Reviews
Tabs: My Reviews (assigned to me) and All Reviews (organisation-wide)
Each review applies to a Document, Control, or Policy
Reviewers can Approve or Request Changes
Effectiveness ratings (Effective, Partially Effective, Ineffective, Not Assessed) sit on each control's Effectiveness card
Opening Reviews
Admin sidebar → Governance → Reviews. The page shows two tabs:
My Reviews: reviews assigned to you
All Reviews: every review in your organisation
What each review row shows
Column | Meaning |
Title | Title of the item being reviewed and a short note explaining why the review was requested |
Type | Document, Control, or Policy |
Requested | When the review was raised |
Due Date | When a decision is required by |
Click any row to open the review.
Approving or requesting changes
The review detail page opens in Review Mode with a banner at the top showing the requestor's notes. Two actions are available:
Request Changes: send the item back with feedback
Approve: confirm the item meets the requirements
Below the action banner, the full document or control is shown with its Status, Renewal, Review, and Frameworks cards, plus tabs for Evidence, Controls, Tasks, Comments, and Version History.
How effectiveness ratings work
Effectiveness sits on each control's Effectiveness card (open the control from the Controls page). Ratings:
Effective: the control is working as intended
Partially Effective: the control is in place but not fully working
Ineffective: the control is in place but not working
Not Assessed: the control has not been formally rated
To update a rating, click Update Rating on the control's Effectiveness card.
When reviews are triggered
Reviews are scheduled or triggered:
Scheduled: based on the control or document's renewal cadence
Audit-triggered: raised by an internal or external audit finding
Incident-triggered: raised after an investigation substantiates findings
The trigger is recorded in the review's Notes field at the top of the review page.
Related articles
The control library (4.2)
Assigning control owners and managing renewals (4.3)
Audit management (6.9)