Integrations
Connects to the tools you use
Set up connections through ERP.AI and Proto workflows, with every change logged.
- Compliance Management
- Authority sources
- Evidence repository
- File access
Compliance Management · Available now
Example screen with sample data
Keep obligations and control work tied to evidence and decisions.
Compliance Management organizes an organization's obligations, rated risks and owned controls around periodic assessments. A compliance lead sets the assessment scope and period, assigns an owner and records planned tests.
- No per-user fees
- Manual work is free
- Configure it in Proto
OverviewAssessments in progress×
Compliance Management · Assessments
New assessment
Assessments in progress
review waits for the compliance lead
Assessments in view
6Planned
2Testing
2Review
1| Record number | Subject | Status | Period start | Period end | Owner | |
|---|---|---|---|---|---|---|
| ASS-46170 | 2026 vendor access review | Planned | 27 Oct | 02 Nov | Clara Mensah | |
| ASS-11740 | Quarterly payment control testing | Testing | 15 Oct | 23 Oct | Irene Salgado | |
| ASS-72809 | Data retention policy assessment | Review | 25 Oct | 29 Oct | Tariq Iwata | |
| ASS-14030 | Warehouse safety compliance review | Remediation | 17 Oct | 21 Oct | Luis Park | |
| ASS-52015 | Annual privacy controls assessment | Planned | 27 Oct | 31 Oct | Evan Farouk |
6 of 6 records
2026 vendor access reviewAssessments · ASS-46170
PlannedPeriod start27 Oct
Period end02 Nov
OwnerClara Mensah
Approve obligationASS-46170 · 2026 vendor access review
Independent Reviewer decides with a reason and source revision.
Waiting for Independent Reviewer
ApproveReturn
- Tables, ready to use
- 15
- Saved views
- 12
- Roles with set permissions
- 6
- Reports and dashboards
- 8
Features
See the work behind each decision
Every feature works on the same records. Pick one to see the screen your team works in.
Obligations
Track regulatory scope and review decisions against an assessment.
- Intake
- Review
- Follow-through
- Regulatory obligations
- Assessments
- Organizations
- Review decisions
OverviewObligation review queue×
Compliance Management · Obligations
New
Obligation review queue
Approval conditions
| Id | Status | Revision | Jurisdiction | Authority source | Parent | |
|---|---|---|---|---|---|---|
| OBL-2026-0041 | Submitted | 730 | California | State privacy statute | Customer record access audit | |
| OBL-2026-0042 | Submitted | 810 | New York | Workplace safety regulation | Warehouse safety compliance review | |
| OBL-2026-0043 | Submitted | 250 | Ontario | Payment services rule | Quarterly payment control testing | |
| OBL-2026-0044 | Submitted | 520 | England and Wales | Data retention policy | Quarterly payment control testing | |
| OBL-2026-0045 | Submitted | 730 | New South Wales | Supplier contract standard | Incident response readiness check |
6 of 6 records
OBL-2026-0041Regulatory obligations · RO-10889
SubmittedRevision730
JurisdictionCalifornia
Authority sourceState privacy statute
ParentCustomer record access audit
Risks and controls
Connect rated business risks to owned safeguards.
- Risk record
- Control record
- Test context
- Risks
- Controls
- Business units
- Team members
- Assessment tests
- Findings
OverviewActive controls×
Compliance Management · Risks and controls
New
Active controls
Controls
| Control code | Description | Effective from | Risk | Owner | |
|---|---|---|---|---|---|
| ACCESS-REV-01 | Former contractor account stayed active | 31 Oct | Single-person payment approval | Clara Mensah | |
| PAY-APR-02 | Require two approvals for payments | 23 Oct | Unreported warehouse safety hazards | Asha Benali | |
| DATA-RET-03 | Archive owner is missing from schedule | 14 Oct | Outdated customer privacy notice | Luis Park | |
| SAFE-INS-04 | Inspect warehouse exits each week | 14 Oct | Unvetted third-party data access | Hana Okonkwo | |
| PRIV-NOT-05 | Privacy notice uses an older version | 27 Oct | Outdated customer privacy notice | Evan Farouk |
6 of 6 records
ACCESS-REV-01Controls · CNT-11952
DescriptionFormer contractor account stayed active
Effective from31 Oct
RiskSingle-person payment approval
OwnerClara Mensah
Assessments
Plan an assessment period, scope and accountable owner.
- Plan
- Execute
- Close
- Assessments
- Assessment tests
- Findings
- Regulatory obligations
- Record attachments
- Operation receipts
OverviewMy assessments×
Compliance Management · Assessments
New
My assessments
Assessments
| Record number | Subject | Status | Period start | Owner | |
|---|---|---|---|---|---|
| ASS-50829 | 2026 vendor access review | Draft | 01 Nov | Evan Farouk | |
| ASS-24887 | Quarterly payment control testing | Planned | 23 Oct | Clara Mensah | |
| ASS-63208 | Data retention policy assessment | Testing | 25 Oct | Nico Shah | |
| ASS-96289 | Warehouse safety compliance review | Review | 11 Oct | Tariq Iwata | |
| ASS-77326 | Annual privacy controls assessment | Approved | 27 Oct | Evan Farouk |
6 of 6 records
2026 vendor access reviewAssessments · ASS-50829
DraftPeriod start01 Nov
OwnerEvan Farouk
Control testing
Record tested samples, exceptions and evidence.
- Select
- Record
- Respond
- Assessment tests
- Assessments
- Controls
- Findings
- Retests
OverviewFailed tests×
Compliance Management · Control testing
New
Failed tests
Assessment tests
| Control code | Tested at | Sample size | Exception count | Evidence reference | Parent | |
|---|---|---|---|---|---|---|
| ACCESS-REV-01 | 22 Oct | 930 | 6 | TEST-2026-0184 | Annual privacy controls assessment | |
| PAY-APR-02 | 16 Oct | 680 | 16 | TEST-2026-0185 | Annual privacy controls assessment | |
| DATA-RET-03 | 25 Oct | 40 | 20 | LOG-2026-0412 | Incident response readiness check | |
| SAFE-INS-04 | 30 Oct | 820 | 26 | LOG-2026-0413 | Annual privacy controls assessment | |
| PRIV-NOT-05 | 25 Oct | 460 | 16 | DOC-2026-0221 | Warehouse safety compliance review |
6 of 6 records
ACCESS-REV-01Assessment tests · AT-35055
Tested at22 Oct
Sample size930
Exception count6
Evidence referenceTEST-2026-0184
ParentAnnual privacy controls assessment
Findings and remediation
Assign a correction and check the result independently.
- Finding
- Correction
- Verification
- Findings
- Corrective actions
- Retests
- Assessments
- Controls
- Team members
OverviewCorrections awaiting verification×
Compliance Management · Findings and remediation
New
Corrections awaiting verification
Approval conditions
| Finding | Status | Due at | Completed at | Evidence | Owner | |
|---|---|---|---|---|---|---|
| Privacy notices use an older version | Submitted | 12 Oct | offboarding_access_review.pdf | Asha Benali | ||
| Privacy notices use an older version | Submitted | 29 Oct | payment_approval_log.xlsx | Irene Salgado | ||
| Former contractor retains system access | Submitted | 20 Oct | retention_schedule_v3.pdf | Asha Benali | ||
| Incident drill actions remain open | Submitted | 24 Oct | safety_inspection_oct.pdf | Luis Park | ||
| Privacy notices use an older version | Submitted | 01 Nov | privacy_notice_signoff.pdf | Nico Shah |
6 of 6 records
offboarding_access_review.pdfCorrective actions · CA-50209
SubmittedFindingPrivacy notices use an older version
Due at12 Oct
OwnerAsha Benali
Review and evidence
Keep decisions, attachments and operation outcomes traceable.
- Decision
- Evidence
- Outcome
- Review decisions
- Record attachments
- Operation receipts
- Assessments
- Regulatory obligations
- Team members
OverviewFailed operations×
Compliance Management · Review and evidence
New
Failed operations
Operation receipts
| Operation key | Action | Result state | Occurred at | Failure reason | Parent | |
|---|---|---|---|---|---|---|
| test-access-2026q4 | Open finding | Failed | 29 Oct | Evidence file could not be opened | Customer record access audit | |
| approve-payment-2026q4 | Assign remediation | Needs review | 14 Oct | Control owner has not signed off | Third-party risk review | |
| check-retention-2026q4 | Verify evidence | Failed | 14 Oct | Test sample is incomplete | Annual privacy controls assessment | |
| inspect-safety-2026q4 | Approve assessment | Needs review | 14 Oct | Remediation due date has passed | Incident response readiness check | |
| review-privacy-2026q4 | Close corrective action | Failed | 01 Nov | Policy version needs approval | Third-party risk review |
6 of 6 records
test-access-2026q4Operation receipts · OR-98706
FailedActionOpen finding
Occurred at29 Oct
Failure reasonEvidence file could not be opened
ParentCustomer record access audit
Process
Follow the assessment through correction
Assessment to verified correction ships ready to use. One step needs a named approval before the work moves on: Approve obligation (Independent Reviewer).
Drag a card to another stage, or focus it and use the arrow keys. It updates to match the stage.
-
Plan assessment
Set the period, scope and owner before testing begins.
2026 vendor access reviewASS-46170 · Compliance LeadPlan assessmentBy Compliance Lead -
Test control
Record the sample, exceptions and evidence for the safeguard checked.
2026 vendor access reviewASS-46170 · TesterTest controlBy Tester -
Review findings
Turn failed tests into described issues with severity and ownership.
2026 vendor access reviewASS-46170 · Compliance LeadReview findingsBy Compliance Lead -
Approve obligation
A reviewer records a reasoned decision on the submitted revision.
2026 vendor access reviewASS-46170 · Independent ReviewerApprove obligationBy Independent ReviewerApprovalIndependent Reviewer decides with a reason and source revision. -
Remediate finding
An owner submits the correction and its evidence.
2026 vendor access reviewASS-46170 · Remediation OwnerRemediate findingBy Remediation Owner -
Verify correction
A separate reviewer tests the result before closure.
2026 vendor access reviewASS-46170 · Independent ReviewerVerify correctionBy Independent Reviewer
Inside a record
Keep source evidence within reach
Open any assessment to see its assessment tests, the roles that work on it, its process stages and its approvals on one page.
- 1Record details
Period start, Period end and Owner.
- 2Assessment tests
Each line is linked to this assessment.
- 3Who works on it
Admin, Compliance Lead and Control Owner, each with their own permissions.
- 4Process stages
Plan assessment and Test control, with the role that acts.
- 5Approvals
Approve obligation, with who decides.
Assessments in progress2026 vendor access review×
Compliance Management · Assessments
Log activity
2026 vendor access review
Planned
1
Record details
Period start27 Oct
Period end02 Nov
OwnerClara Mensah
2
Assessment tests
2026 vendor access review
| Control code | Tested at | Sample size |
|---|---|---|
| ACCESS-REV-01 | 22 Oct | 930 |
| PAY-APR-02 | 16 Oct | 680 |
| DATA-RET-03 | 25 Oct | 40 |
- Assessment tests
- 6
- Total sample size
- 3,820
3
Who works on it
- AdminManage Organizations, business units, team members, Users
- Compliance LeadManage Assessments, regulatory obligations, record attachments
- Control OwnerManage Risks, Controls
4
Process stages
- Plan assessmentCompliance Lead
- Test controlTester
5
Approvals
- Approve obligationIndependent ReviewerApproved
Approvals
Keep review decisions attributable
OverviewApprovals×
Compliance Management · Overview
Approvals
Signed in as Independent Reviewer
Waiting for you
4 To review1 Overdue2 Decided todayOnly mine
0 selectedApproveReturn
- CA-50209offboarding_access_review.pdfSubmitted0dActions
- CA-39366payment_approval_log.xlsxSubmitted2dActions
- CA-70298retention_schedule_v3.pdfSubmitted2dActions
- CA-88991safety_inspection_oct.pdfSubmitted4dActions
Who approves what
| Decision | Approver | |
|---|---|---|
| Approve obligationA reviewer records a reasoned decision on the submitted revision. | Independent Reviewer |
1 approval rule · set per role in Proto
Roles
A workspace for each role
Everyone opens Compliance Management to the work that is theirs. Pick a role to see what it starts with.
Admin
Sets organization access and maintains the people and business units used to scope work.
- Manage Organizations, business units, team members, Users
- View Assessments, regulatory obligations, operation receipts
Compliance Lead
Owns assessment scope, obligation review routing and the operating record for the compliance program.
This is the first screen this role sees.
OverviewAssessment schedule×
Assessment schedule
Assessments · Compliance Lead
| Record number | Subject | Period start | Period end | Status | |
|---|---|---|---|---|---|
| ASS-56165 | 2026 vendor access review | 23 Oct | 25 Oct | Planned | |
| ASS-73096 | Quarterly payment control testing | 15 Oct | 22 Oct | Testing | |
| ASS-92607 | Data retention policy assessment | 03 Nov | 10 Nov | Review | |
| ASS-50901 | Warehouse safety compliance review | 04 Nov | 07 Nov | Planned | |
| ASS-78679 | Annual privacy controls assessment | 25 Oct | 27 Oct | Testing |
6 of 6 records
Control Owner
Maintains a control and the risk it addresses, then responds to test exceptions.
This is the first screen this role sees.
OverviewActive controls×
Active controls
Controls · Control Owner
| Control code | Description | Effective from | Risk | Owner | |
|---|---|---|---|---|---|
| ACCESS-REV-01 | Former contractor account stayed active | 31 Oct | Single-person payment approval | Clara Mensah | |
| PAY-APR-02 | Require two approvals for payments | 23 Oct | Unreported warehouse safety hazards | Asha Benali | |
| DATA-RET-03 | Archive owner is missing from schedule | 14 Oct | Outdated customer privacy notice | Luis Park | |
| SAFE-INS-04 | Inspect warehouse exits each week | 14 Oct | Unvetted third-party data access | Hana Okonkwo | |
| PRIV-NOT-05 | Privacy notice uses an older version | 27 Oct | Outdated customer privacy notice | Evan Farouk |
6 of 6 records
Tester
Records control tests and identifies findings for assessment review.
This is the first screen this role sees.
OverviewAssessment schedule×
Assessment schedule
Assessments · Tester
| Record number | Subject | Period start | Period end | Status | |
|---|---|---|---|---|---|
| ASS-56165 | 2026 vendor access review | 23 Oct | 25 Oct | Planned | |
| ASS-73096 | Quarterly payment control testing | 15 Oct | 22 Oct | Testing | |
| ASS-92607 | Data retention policy assessment | 03 Nov | 10 Nov | Review | |
| ASS-50901 | Warehouse safety compliance review | 04 Nov | 07 Nov | Planned | |
| ASS-78679 | Annual privacy controls assessment | 25 Oct | 27 Oct | Testing |
6 of 6 records
Remediation Owner
Plans and completes corrective work assigned to a finding.
This is the first screen this role sees.
OverviewFindings needing action×
Findings needing action
Findings · Remediation Owner
Low2
Former contractor account stayed activeCustomer record access audit
15 Oct
Privacy notice uses an older versionWarehouse safety compliance review
13 Oct
Add
Medium2
Require two approvals for paymentsWarehouse safety compliance review
25 Oct
Vendor review expired last monthIncident response readiness check
27 Oct
Add
High1
Archive owner is missing from scheduleIncident response readiness check
03 Nov
Add
Critical1
Inspect warehouse exits each weekWarehouse safety compliance review
03 Nov
Add
Independent Reviewer
Decides submitted obligation reviews and records independent follow-up tests.
This is the first screen this role sees.
OverviewCorrections awaiting verification×
Corrections awaiting verification
Corrective actions · Independent Reviewer
| Finding | Status | Due at | Completed at | Evidence | Owner | |
|---|---|---|---|---|---|---|
| Privacy notices use an older version | Submitted | 12 Oct | offboarding_access_review.pdf | Asha Benali | ||
| Privacy notices use an older version | Submitted | 29 Oct | payment_approval_log.xlsx | Irene Salgado | ||
| Former contractor retains system access | Submitted | 20 Oct | retention_schedule_v3.pdf | Asha Benali | ||
| Incident drill actions remain open | Submitted | 24 Oct | safety_inspection_oct.pdf | Luis Park | ||
| Privacy notices use an older version | Submitted | 01 Nov | privacy_notice_signoff.pdf | Nico Shah |
6 of 6 records
Reports
Read results from actual records
Read progress, exceptions and review outcomes from operating records.
Overview×
Compliance Management · Overview
Compliance Management dashboard
This quarter
Corrective actions in view
6Submitted
6Due at within 14 days
3Assessments by status
How far records got this quarter
| Stage | Reached | Step | |
|---|---|---|---|
| Draft | 42 | ||
| Planned | 22 | 52% | |
| Testing | 13 | 59% | |
| Review | 9 | 69% |
Number of assessments by status
Sample counts per stage
- 01Assessment progress
Group assessments by Status and Owner for the selected period.
- 02Test results by control
Compare assessment tests Result and exception count beneath each Control.
- 03Open findings by severity
Count Findings by Severity and Status for an assessment.
- 04Corrective action due work
List corrective actions by due at, Owner and Status.
- 05Retest outcomes
Show Retests Result and tested at beneath each Finding.
- 06Obligation review outcomes
Group regulatory obligations by Status, Jurisdiction and decision at.
- 07Risk ratings by business unit
Compare Risks Likelihood and Impact beneath each business unit.
- 08Operation exceptions
List operation receipts with Failed or needs review result state and their failure reason.
Who it's for
Fit the operating structure
See how Compliance Management fits your kind of team.
Controls
Trace a test to its safeguard
Each stage of assessment to verified correction names the role that acts and the status it records, so a change is never anonymous.
OverviewAssessment to verified correction×
Compliance Management · Process
Assessment to verified correction
Each stage, the role that acts and the status it records
Process stages
10Approval steps
1Roles involved
5Tables touched
12Prepare control
Control OwnerStatusDraft → Active
RecordsControls, Risks
Plan assessment
Compliance LeadStatusDraft → Planned
RecordsAssessments
Test control
TesterStatusPlanned → Testing
RecordsAssessment tests, Assessments
- StartControlsPrepare controlDraft → Active
- StepAssessmentsPlan assessmentDraft → Planned
- StepAssessment testsTest controlPlanned → Testing
- StepAssessmentsReview findingsTesting → Review
- ApprovalRegulatory obligationsApprove obligationSubmitted → Approved
AI agent
Prepare the next review with Proto
Use Proto to prepare compliance records and review the next decision.
It can
- Compliance Lead: Summarize assessments in review, open findings and obligation decisions for a named organization.
- Control Owner: Bring together an active control, its rated risk and the latest failed test for discussion.
- Tester: Prepare a checklist of the sample, exception count and evidence reference to record for a scoped check.
- Remediation Owner: List assigned corrective actions and their due dates for the current assessment.
Stays with a person
- Proto can prepare a record or point a person to a missing detail.
- The named owner still confirms scope, evidence and any status change.
- The Independent Reviewer makes the approval or retest decision and records the reason.
- A summary of a failed test is not a substitute for opening its evidence.
Show the submitted obligations for this assessment with their source revision and authority source. I will review the underlying records before recording a decision.
Proto can prepare a record or point a person to a missing detail.
Data model
Your data, in tables you can change
Every record lives in a table you can see, extend and export. Add fields or whole tables in Proto.
Browse all 15 tables15tables
- Obligations4
- Risks and controls6
- Assessments6
- Control testing5
- Findings and remediation6
- Review and evidence6
Implementation
Roll out one team at a time
Start with one team and one process, then add the rest once the basics are running.
Set the organization
Create the organization, business unit and linked people who will own the first review.
Map risk and control
Choose a real risk, record its rating scale and assign an active safeguard to a Control Owner.
Plan the assessment
State the period, scope and planned tests; identify the Tester and Independent Reviewer.
Run a sample
Record a test with evidence, create a finding for an exception and assign corrective work.
Review the result
Submit an obligation for a reasoned decision and have a different person retest the correction.
Pricing
$0per user
The base account and everyday work in the ERP.AI app are free, for every user.
- No per-user or per-seat fees
- Viewing, editing, approving and exporting records in the app is free
- Pay only for machine work: API calls, imports, workflows and AI agents
- Prepaid credits from $5. Purchased credits never expire
Machine work rate card Included per $1 of credit
| Usage | Per $1 |
|---|---|
| Record reads (list, filter, get) | 20,000 |
| Search or aggregate queries | 4,000 |
| Record writes | 4,000 |
| Imported or synced records | 200,000 |
| Workflow runs | 2,000 |
| AI agent runs | 2,000 |
| Scheduled jobs or webhooks | 20,000 |
| File uploads (MB) | 2,000 |
| CSV or PDF exports | 100 |
How do I get started?
Click Get started, then use Proto to configure Compliance Management for your business. Begin with one organization, one business unit, a scoped assessment and a control whose owner can supply test evidence.
What belongs in an assessment?
Record the subject, owner, business unit, period, scope statement and planned tests. Link tests, obligations, findings and supporting attachments to that assessment.
How are risks connected to controls?
A risk belongs to a business unit and has a named owner, likelihood, impact and scale version. A control links to that risk and has its own owner, description and effective date.
How do testers record an exception?
The Tester records a control test with sample size, exception count, result and evidence reference. A finding then describes the issue and links to the affected assessment and control.
Who approves an obligation review?
The Independent Reviewer examines the submitted obligation and records a decision, reason and source revision. The Compliance Lead handles a returned or rejected item.
What happens after a corrective action is submitted?
An Independent Reviewer records a separate retest result and evidence against the finding. The team can then verify a passing correction or continue work after a failed or inconclusive result.
Where do supporting files go?
Record attachments belong to assessments and carry a visibility choice. Test and corrective action records can also hold evidence references that the team agrees how to resolve.
How do I see work that needs attention?
Operations Overview shows tests performed, failed tests, pending review decisions and failed operations for the authorized scope. Working lists show submitted obligations, findings and corrective actions.
Can we compare risk ratings across business units?
Yes, review likelihood and impact with the scale version used for each risk. Agree on how to interpret different versions before comparing ratings.
How is a failed operation handled?
Open its receipt, review the action, expected revision, failure reason and effect references, and compare those with the assessment records before treating the work as complete.
Set up Compliance Management your way.
Start free, then use Proto to change fields, steps and approvals before your team goes live.