Compliance work that runs on schedule and proves itself.
Turn recurring reviews, control tests, and audit preparation into workflows with named owners, due dates, and required evidence. Every run records who did what, when, and what they attached, so the audit trail is already there when the auditor asks.
SOC 2 Type II · Four-eyes approvals · Exportable history · Workflow versioning
Quarterly Access Review
Compliance · Q2 2026
- Export user list from each system
- Managers confirm access is still required
- Remove access flagged for revocation
- Attach evidence of removals Due today
- Compliance lead approves and closes
The review happens every quarter, whether or not anyone remembers.
Schedule access reviews, policy attestations, vendor assessments, and control tests to start on their own. Each run assigns steps to roles, so the right person gets the work even when the team changes.
- Runs start on a calendar or business-day schedule
- Steps are assigned by role, not by name
- Reminders and escalations go out automatically when a step is late
Every step captures the evidence the auditor will ask for.
Make a file upload, a value, or a sign-off required before a step can be completed. Add an approval step so a second person has to review before the run closes. Nothing is marked done without the proof attached.
- Required attachments, fields, and subtasks on any step
- Four-eyes approvals with the decision recorded in the run
- Directions, procedures, and links embedded in the step itself
Export the removal log from each system and attach it here. The compliance lead reviews it in the next step.
- Number of accounts removed
- Date removals were completed
- Removal log (file upload)
The history is already written when the audit starts.
Each run keeps a complete, searchable record of who completed each step, when, what they entered, and what they attached. Export it for the auditor, or give them read access to the runs themselves.
- Searchable activity log on every run
- Reporting and data exports for the period under review
- Workflow versioning shows which procedure was in force at the time
Compliance workflows teams run in Manifestly.
Start from one of these, or import your own procedure and edit the steps.
Access reviews
- Quarterly user access review
- Privileged account review
- Offboarding access removal
Control testing
- Monthly control test
- Change management review
- Backup and restore verification
Policy and training
- Annual policy attestation
- Security awareness training
- New-hire compliance onboarding
Vendors and third parties
- Vendor risk assessment
- Annual vendor review
- SOC 2 report review
Audit preparation
- Evidence collection by control
- Auditor request tracking
- Finding remediation
Incidents and exceptions
- Incident response
- Policy exception approval
- Root cause review
Controls for regulated organizations.
SSO and permissions
SAML SSO, departments, and role-based permissions keep compliance runs visible to the people who should see them and no one else.
Workflow versioning
Each run records the version of the procedure it followed, so you can show an auditor exactly what the process was on any given date.
Questions from compliance teams.
Run compliance with nothing left to reconstruct.
Start with one review. Your team can run it this quarter.