The compliance manager is usually the only person who sees the whole program at once: every framework, every control, every owner, and every date an auditor will ask about. That visibility is the job's leverage and its burden. The goal is to turn certification from an annual project into a steady operating rhythm, where evidence is current on any given Tuesday and audit fieldwork is mostly a matter of granting access.
What sits on your plate
- Scope and control set: maintaining the list of in-scope systems, locations, and processes, and the control set that covers them, including the Statement of Applicability for ISO 27001.
- Policies: owning the policy library, the annual review cycle, and employee acknowledgement tracking.
- Evidence: knowing which artefact proves which control, who produces it, and when it expires.
- Audits: coordinating external auditors and supporting internal audit, then driving findings to closure.
- Reporting upward: giving the CISO a reliable status on readiness, gaps, and overdue actions.
Notice what is not on the list: operating the controls themselves. Access reviews, backups, vulnerability scans, and change approvals belong to the people who run those systems. Your role is to define what good evidence looks like, schedule it, and check it arrives. When compliance managers end up taking screenshots themselves, the program becomes fragile and the manager becomes the bottleneck.
Evidence refresh cadences
Most evidence goes stale on a predictable schedule. Mapping each artefact to a refresh frequency and an owner is the single most useful thing you can do before an audit period starts. The table below is a starting point; adjust frequencies to what your policies actually commit to, because auditors test against your documented cadence.
A 90-day audit readiness run
- Day 90: confirm scope, audit dates, and sample periods with the auditor; circulate the evidence request list to owners.
- Day 75: run a gap check against current evidence; open tracked tasks for anything missing or expired.
- Day 45: close policy approvals and training gaps, which are slow because they depend on other teams.
- Day 30: run an internal walkthrough of high-risk controls with their owners so nobody meets the auditor cold.
- Day 14: freeze the evidence set, set up auditor access, and brief owners on the interview schedule.
- Fieldwork: triage requests daily, track every question to an owner, and log draft findings as they surface.
Handoffs that keep you out of the middle
Friction usually shows up at the boundaries. With the IT lead, agree evidence requests as tickets with a due date and an example of acceptable evidence, not free-text emails. With the risk manager, agree that every audit finding and control gap is assessed as a risk so it gets a treatment decision instead of sitting on a list. With internal audit, share the control library and evidence set, then step back so their testing stays independent.
What to test in a GRC platform
- Evidence records carry an owner and an expiry date, with reminders before they lapse
- One control can be mapped to several frameworks without duplicating the evidence
- Policy versioning, approval workflow, and acknowledgement tracking live in one place
- External auditors get a scoped workspace to request, review, and comment
- Findings convert into tracked corrective actions with owners and deadlines
- Evidence can be pulled directly from source systems rather than uploaded by hand
Asurvo's Governance module covers the policy center, control library, and evidence management with expiry tracking and reuse, and its Audit module handles requests, findings, and CAPA inside an auditor workspace. Cross-mapping means a single piece of evidence can satisfy multiple frameworks at once.