Policy Management System · Available now

Keep policy decisions and assurance evidence together.

A governance team can keep a policy version beside the assessment that prompted its review. The assessment identifies the organization, operating unit, owner, period and scope.

Start now Download Proto

No per-user fees
Manual work is free
Configure it in Proto

OverviewAssessments by status

Policy Management System · Assessments

Assessments by status

testing waits for the assigned tester

New assessment

Assessments in view

Planned

Testing

Review

Record number	Subject	Status	Period start	Period end	Owner
ASS-85938	Q1 access controls review	Planned	04 Nov	08 Nov	Fatima Bello
ASS-55089	Annual vendor oversight assessment	Testing	29 Oct	06 Nov	Ibrahim Diallo
ASS-32451	Quarterly privacy controls test	Review	25 Oct	30 Oct	Jonah Reed
ASS-22030	Records retention review	Planned	26 Oct	31 Oct	Camila Torres
ASS-96235	Payment approval controls test	Testing	25 Oct	02 Nov	Daniel Cho

6 of 6 records

Q1 access controls reviewAssessments · ASS-85938

Planned

Period start04 Nov

Period end08 Nov

OwnerFatima Bello

Review revisionASS-85938 · Q1 access controls review

Independent Assurance Reviewer decides on the assessment revision.

Waiting for Independent Assurance Reviewer

ApproveReturn

Example screen with sample data

Tables, ready to use: 15
Saved views: 12
Roles with set permissions: 5
Reports and dashboards: 8

Features

Follow each policy version

Every feature works on the same records. Pick one to see the screen your team works in.

Policy versions

Review a named policy version and track its audience acknowledgment.

Version
Audience
Decision

Policy acknowledgements
Review decisions
Assessments
Organizations
Operation receipts

Explore policy versions

OverviewPolicy decision queue

Policy Management System · Policy versions

Policy decision queue

Approval conditions

New

Policy version	Audience	Revision	Status	Decision at
Version 1.0	All employees	960	Submitted	21 Oct
Version 1.1	Finance approvers	290	Submitted	22 Oct
Version 2.0	System administrators	330	Submitted	28 Oct
Version 2.1	Vendor managers	510	Submitted	02 Nov
Version 3.0	People operations	90	Submitted	19 Oct

6 of 6 records

Version 1.0Policy acknowledgements · PA-29967

Submitted

AudienceAll employees

Revision960

Decision at21 Oct

Example screen with sample data

Assessments

Set assessment scope, period and ownership before testing starts.

Scope
Ownership
Revision

Assessments
Assessment tests
Business units
Organizations
Team members
Findings

Explore assessments

OverviewReview queue

Policy Management System · Assessments

Review queue

Assessments

New

Record number	Subject	Revision	Status	Owner
ASS-46664	Q1 access controls review	600	Review	Sofia Alvarez
ASS-40136	Annual vendor oversight assessment	160	Review	Fatima Bello
ASS-56482	Quarterly privacy controls test	470	Review	Fatima Bello
ASS-82402	Records retention review	510	Review	Meera Patel
ASS-32069	Payment approval controls test	90	Review	Jonah Reed

6 of 6 records

Q1 access controls reviewAssessments · ASS-46664

Review

Revision600

OwnerSofia Alvarez

Example screen with sample data

Risks and controls

Connect unit risks to active controls and named owners.

Unit risk
Owned control
Test link

Risks
Controls
Business units
Team members
Assessment tests
Findings

Explore risks and controls

OverviewActive controls

Policy Management System · Risks and controls

Active controls

Controls

New

Control code	Description	Effective from	Risk	Owner
AC-01	Two reviews lacked manager signoff	21 Oct	Missing privacy acknowledgments	Nikolai Varga
AP-02	Payment sample had no second approval	21 Oct	Unapproved supplier payment	Linh Tran
VR-03	Vendor review expired before renewal	17 Oct	Records kept beyond retention	Linh Tran
BC-04	Restore test evidence was not retained	13 Oct	Late incident notification	Fatima Bello
IR-05	Escalation contact list was outdated	30 Oct	Backup restore failure	Aisha Rahman

6 of 6 records

AC-01Controls · CNT-77232

DescriptionTwo reviews lacked manager signoff

Effective from21 Oct

RiskMissing privacy acknowledgments

OwnerNikolai Varga

Example screen with sample data

Control testing

Capture sampled results, exceptions and evidence under each assessment.

Test
Evidence
Exception

Assessment tests
Assessments
Controls
Record attachments
Findings

Explore control testing

OverviewFailed tests

Policy Management System · Control testing

Failed tests

Assessment tests

New

Control code	Sample size	Exception count	Evidence reference	Parent
AC-01	480	31	Q1-access-review.xlsx	Records retention review
AP-02	750	36	payment-sample-04.pdf	Payment approval controls test
VR-03	270	22	vendor-review-may.pdf	Quarterly privacy controls test
BC-04	120	19	restore-test-log.txt	Annual vendor oversight assessment
IR-05	800	31	incident-drill-notes.pdf	Third party data handling review

6 of 6 records

AC-01Assessment tests · AT-22264

Sample size480

Exception count31

Evidence referenceQ1-access-review.xlsx

ParentRecords retention review

Example screen with sample data

Findings and remediation

Assign corrective work and keep independent retest evidence.

Finding
Action
Retest

Findings
Corrective actions
Retests
Assessment tests
Controls
Assessments

Explore findings and remediation

OverviewMy corrective actions

Policy Management System · Findings and remediation

My corrective actions

Corrective actions

New

Finding	Status	Due at	Owner
Payment approval evidence incomplete	Planned	03 Nov	Aisha Rahman
Vendor questionnaire expired	In progress	25 Oct	Ibrahim Diallo
Vendor questionnaire expired	Submitted	31 Oct	Fatima Bello
Departed account disabled late	Verified	01 Nov	Meera Patel
Training exceptions lack owner	Planned	29 Oct	Camila Torres

6 of 6 records

Payment approval evidence incompleteCorrective actions · CA-53689

Planned

Due at03 Nov

OwnerAisha Rahman

Example screen with sample data

Review and evidence

Tie independent decisions, attached files and operation receipts to the case.

Decision
Attachment
Receipt

Review decisions
Record attachments
Operation receipts
Assessments
Policy acknowledgements

Explore review and evidence

OverviewReceipts needing review

Policy Management System · Review and evidence

Receipts needing review

Operation receipts

New

Operation key	Action	Expected revision	Result state	Failure reason
approve-q1-access-r2	Approve assessment	290	Needs review	Approval evidence is missing
test-payment-ap-02	Record test result	680	Needs review	Control owner is inactive
close-vendor-finding-03	Open finding	300	Needs review	Test period has closed
publish-retention-v3	Close remediation	730	Needs review	Policy version has changed
record-backup-test-04	Publish policy version	650	Needs review	Remediation proof is incomplete

6 of 6 records

approve-q1-access-r2Operation receipts · OR-76031

Needs review

ActionApprove assessment

Expected revision290

Failure reasonApproval evidence is missing

Example screen with sample data

Process

From scope to acknowledgment

Reviewed policy and assurance cycle ships ready to use. 2 steps need a named approval before the work moves on: Review revision (Independent Assurance Reviewer) and Record policy decision (Independent Assurance Reviewer).

Drag a card to another stage, or focus it and use the arrow keys. It updates to match the stage.

Scope assessment

Set the unit, period and owner for the cycle.

Q1 access controls reviewASS-85938 · Control Owner
Scope assessmentBy Control Owner
Test controls

Record samples, exceptions and evidence against active controls.

Q1 access controls reviewASS-85938 · Assigned Tester
Test controlsBy Assigned Tester
Record findings

Carry failed results into assigned corrective work.

Q1 access controls reviewASS-85938 · Control Owner
Record findingsBy Control Owner
Review revision

An independent reviewer decides on the submitted assessment revision.

Q1 access controls reviewASS-85938 · Independent Assurance Reviewer
Review revisionBy Independent Assurance Reviewer
ApprovalIndependent Assurance Reviewer decides on the assessment revision.
Record policy decision

An independent reviewer decides on the submitted policy version.

Q1 access controls reviewASS-85938 · Independent Assurance Reviewer
Record policy decisionBy Independent Assurance Reviewer
ApprovalIndependent Assurance Reviewer decides on the policy version.
Reconcile completion

Compare the operation receipt with persisted effects.

Q1 access controls reviewASS-85938 · Independent Assurance Reviewer
Reconcile completionBy Independent Assurance Reviewer

Start with Assessment and testing

Inside a record

Connect the handoffs you use

Open any assessment to see its assessment tests, the roles that work on it, its process stages and its approvals on one page.

1
Record details
Period start, Period end and Owner.
2
Assessment tests
Each line is linked to this assessment.
3
Who works on it
Control Owner and Assigned Tester, each with their own permissions.
4
Process stages
Scope assessment and Test controls, with the role that acts.
5
Approvals
Review revision and Record policy decision, with who decides.

Assessments by statusQ1 access controls review

Policy Management System · Assessments

Q1 access controls review

Planned

Log activity

Record details

Period start04 Nov

Period end08 Nov

OwnerFatima Bello

Assessment tests

Q1 access controls review

Control code	Sample size	Exception count
AC-01	480	31
AP-02	750	36
VR-03	270	22

Assessment tests: 6
Total sample size: 2,680

Who works on it

Control OwnerManage assessment tests, Assessments, record attachments
Assigned TesterManage assessment tests, record attachments

Process stages

Scope assessmentControl Owner
Test controlsAssigned Tester

Approvals

Review revisionIndependent Assurance Reviewer
Approved
Record policy decisionIndependent Assurance Reviewer
Waiting

Example screen with sample data

Approvals

Keep decisions with revisions

The Control Owner maintains the assessment and supporting operational records in the scope they own.

OverviewApprovals

Policy Management System · Overview

Approvals

Signed in as Independent Assurance Reviewer

Waiting for you

4 To review1 Overdue2 Decided todayOnly mine

0 selectedApproveReturn

PA-29967Version 1.0
All employeesRequested by Control Owner
Submitted2dActions
PA-94568Version 1.1
Finance approversRequested by Control Owner
Submitted4dActions
PA-42810Version 2.0
System administratorsRequested by Control Owner
Submitted2dActions
PA-32801Version 2.1
Vendor managersRequested by Control Owner
Submitted4dActions

Who approves what

	Decision	Approver
	Review revisionAn independent reviewer decides on the submitted assessment revision.	Independent Assurance Reviewer
	Record policy decisionAn independent reviewer decides on the submitted policy version.	Independent Assurance Reviewer

2 approval rules · set per role in Proto

Example screen with sample data

Who can approve what

Roles

A workspace for each role

Everyone opens Policy Management System to the work that is theirs. Pick a role to see what it starts with.

Control Owner

Prepare assigned operational records and execute eligible reviewed actions.

This is the first screen this role sees.

OverviewAssessment schedule

Assessment schedule

Assessments · Control Owner

Record number	Subject	Period start	Period end	Status
ASS-89217	Q1 access controls review	31 Oct	05 Nov	Planned
ASS-84688	Annual vendor oversight assessment	25 Oct	28 Oct	Testing
ASS-19736	Quarterly privacy controls test	23 Oct	30 Oct	Planned
ASS-13625	Records retention review	04 Nov	12 Nov	Testing
ASS-48254	Payment approval controls test	25 Oct	30 Oct	Planned

6 of 6 records

Example screen with sample data

Independent Assurance Reviewer

Review eligible revisions independently and reconcile operational evidence.

This is the first screen this role sees.

OverviewPolicy decision queue

Policy decision queue

Policy acknowledgements · Independent Assurance Reviewer

Policy version	Audience	Revision	Status	Decision at
Version 1.0	All employees	960	Submitted	21 Oct
Version 1.1	Finance approvers	290	Submitted	22 Oct
Version 2.0	System administrators	330	Submitted	28 Oct
Version 2.1	Vendor managers	510	Submitted	02 Nov
Version 3.0	People operations	90	Submitted	19 Oct

6 of 6 records

Example screen with sample data

Assigned Tester

Records assigned control test results, sample details and evidence for assessment review.

This is the first screen this role sees.

OverviewAssessment schedule

Assessment schedule

Assessments · Assigned Tester

Record number	Subject	Period start	Period end	Status
ASS-89217	Q1 access controls review	31 Oct	05 Nov	Planned
ASS-84688	Annual vendor oversight assessment	25 Oct	28 Oct	Testing
ASS-19736	Quarterly privacy controls test	23 Oct	30 Oct	Planned
ASS-13625	Records retention review	04 Nov	12 Nov	Testing
ASS-48254	Payment approval controls test	25 Oct	30 Oct	Planned

6 of 6 records

Example screen with sample data

Roles and permissions

Reports

Read the evidence behind progress

Read assessment throughput, exceptions, decisions and follow-up from the records.

Overview

Policy Management System · Overview

Policy Management System dashboard

This quarter

Policy acknowledgements in view

Submitted

Assessments by status

How far records got this quarter

Stage	Reached	Step
Draft	49
Planned	22	45%
Testing	8	36%
Review	4	50%

Number of assessments by status

Sample counts per stage

100

10Draft

10Planned

-30Testing

-10Review

-40Approved

Example screen with sample data

All reports and dashboards

Who it's for

Fit the operating model

See how Policy Management System fits your kind of team.

Multi-entity governance

Coordinate policy versions and assessment work across legal entities.

Operating unit assurance

Connect unit risks, control tests and corrective work in one cycle.

Policy operations

Give policy review and acknowledgment a clear decision record.

Controls

Trace tests and corrective work

Each stage of reviewed policy and assurance cycle names the role that acts and the status it records, so a change is never anonymous.

OverviewReviewed policy and assurance cycle

Policy Management System · Process

Reviewed policy and assurance cycle

Each stage, the role that acts and the status it records

Process stages

Approval steps

Roles involved

Tables touched

Scope assessment

Control Owner

StatusDraft → Planned

RecordsOrganizations, Assessments, Controls

Test controls

Assigned Tester

StatusPlanned → Testing

RecordsAssessment tests, Assessments

Review revisionApproval

Independent Assurance Reviewer

StatusReview → Approved

RecordsReview decisions, Assessments

Reviewed policy and assurance cycle

Start
Scope assessmentDraft → Planned
Organizations
Step
Test controlsPlanned → Testing
Assessment tests
Approval
Review revisionReview → Approved
Review decisions
Approval
Record policy decisionSubmitted → Approved
Policy acknowledgements
Step
Assign corrective actionOpen → action planned
Corrective actions

Example screen with sample data

See each stage in detail

AI agent

Prepare work with Proto

Ask Proto to prepare policy and assessment work for a human decision.

It can

Control Owner: Prepare an assessment scope, identify active controls and collect the linked evidence for review.
Assigned Tester: Bring together the test's sample, exceptions and evidence reference before a result is recorded.
Reviewer: Summarize the submitted revision, decisions, findings and attachments so the reviewer can make a dated decision.
Auditor: Trace a policy version from its assessment and decision to acknowledgment and operation receipt.

Stays with a person

The Independent Assurance Reviewer decides whether to approve or return a revision.
The organization sets its policy audience and completion rules.
Proto can prepare and compare records, but a person must confirm evidence, approve a revision and decide whether an exception is resolved.

Set up an agent

agent · policy management system

Show the submitted policy version, its audience, the linked assessment revision and any open findings. Prepare the evidence for the Independent Assurance Reviewer.

The Independent Assurance Reviewer decides whether to approve or return a revision.

Integrations

Connects to the tools you use

Set up connections through ERP.AI and Proto workflows, with every change logged.

Policy Management System
Identity
Policy distribution
Evidence storage

Data model

Your data, in tables you can change

Every record lives in a table you can see, extend and export. Add fields or whole tables in Proto.

Browse all 15 tables

15tables

Policy versions5
Assessments6
Risks and controls6
Control testing5
Findings and remediation6
Review and evidence5

Implementation

Roll out one team at a time

Start with one team and one process, then add the rest once the basics are running.

Establish ownership
Create the organization, business unit and team members. Assign the Control Owner, Independent Assurance Reviewer, App Administrator and Auditor.
Define the model
Name the risk scale, control codes, evidence visibility rule and policy version convention.
Run an assessment
Set a period and scope, record passing and failing tests, and follow the failed case into a finding.
Review and decide
Submit an assessment revision and a policy version for independent decisions. Record reasons and dates.
Reconcile
Check the corrective action and retest, then compare each operation receipt with the effects it expected.

Read the implementation plan

Pricing

$0per user

The base account and everyday work in the ERP.AI app are free, for every user.

No per-user or per-seat fees
Viewing, editing, approving and exporting records in the app is free
Pay only for machine work: API calls, imports, workflows and AI agents
Prepaid credits from $5. Purchased credits never expire

Pricing details

Machine work rate card Included per $1 of credit

Machine work rate card
Usage	Per $1
Record reads (list, filter, get)	20,000
Search or aggregate queries	4,000
Record writes	4,000
Imported or synced records	200,000
Workflow runs	2,000
AI agent runs	2,000
Scheduled jobs or webhooks	20,000
File uploads (MB)	2,000
CSV or PDF exports	100

FAQ

Questions, answered

Scope, rollout and pricing for Policy Management System.

All questions

How do I get started?

Click Get started, then use Proto to configure Policy Management System for your business. Begin with one organization, one policy audience and a short assessment cycle.

Who prepares a policy version?

The Control Owner prepares the version, audience and supporting assessment before an independent decision.

Who decides on a submitted version?

The Independent Assurance Reviewer records the dated decision on the submitted revision. The review reason remains with the decision.

How is acknowledgment tracked?

The policy record holds the version, audience, required reader count and acknowledgment date. Agree what counts as completion for your audience during setup.

Can a returned assessment be corrected?

Yes. The Control Owner prepares a corrected revision and submits it for a new decision while the earlier decision stays visible.

How do tests connect to findings?

Each test points to an assessment and control. A finding records the exception against the same assessment and control.

What closes a finding?

A corrective action records the work. An independent retest with a passing result supports closing the finding.

Can an Auditor change a review decision?

The Auditor reads authorized evidence and reports. The Independent Assurance Reviewer owns the decision.

How are uncertain operations handled?

An operation receipt records the action and expected revision. The reviewer compares actual effects before marking it completed.

Set up Policy Management System your way.

Start free, then use Proto to change fields, steps and approvals before your team goes live.

Start now Download Proto

How to get started

Find your application

Keep policy decisions and assurance evidence together.

Assessments by status

Follow each policy version

Policy versions

Policy decision queue

Assessments

Review queue

Risks and controls

Active controls

Control testing

Failed tests

Findings and remediation

My corrective actions

Review and evidence

Receipts needing review

From scope to acknowledgment

Scope assessment

Test controls

Record findings

Review revision

Record policy decision

Reconcile completion

Connect the handoffs you use

Q1 access controls review

Q1 access controls review

Who works on it

Process stages

Approvals

Keep decisions with revisions

Approvals

Waiting for you

Who approves what

A workspace for each role

Control Owner

Assessment schedule

Independent Assurance Reviewer

Policy decision queue

App Administrator

Auditor

Policy acknowledgments

Assigned Tester

Assessment schedule

Read the evidence behind progress

Policy Management System dashboard

Assessments by status

Number of assessments by status

Fit the operating model

Multi-entity governance

Operating unit assurance

Policy operations

Trace tests and corrective work

Reviewed policy and assurance cycle

Prepare work with Proto

It can

Stays with a person

Connects to the tools you use

Your data, in tables you can change

Roll out one team at a time

Establish ownership

Define the model

Run an assessment

Review and decide

Reconcile

Machine work rate card Included per $1 of credit

Questions, answered

More Legal systems

Legal Practice Management

Contract Lifecycle Management

Compliance Management

Corporate Governance

Litigation Management

Document Automation

Set up Policy Management System your way.

Your Privacy, Your Choice

Manage Your Cookie Preferences