These cookies are required for the website to function properly. They ensure security, enable basic features like page navigation, and store user session data. You cannot disable these cookies.
- Policy Management System
- Data model
The tables behind Policy Management System
Policy Management System ships with 15 tables, grouped here by the feature that uses them. Every record your team works with lives in one of them, and you can add fields and tables in Proto.
- Tables
- 15
- Features
- 6, plus shared settings
- Change it
- Add fields and tables in Proto
How the model is organised
Organization:
Organizations, business units, team members and Users identify the entity, unit and people involved.
Assurance scope:
Risks and Controls define what is assessed; Assessments and assessment tests hold the dated testing cycle.
Exceptions:
Findings, corrective actions and Retests keep observation, repair and independent check distinct.
Policy and evidence:
Policy acknowledgements, review decisions, record attachments and operation receipts hold version decisions, files and guarded operation results.
Every table, by feature
- Policy versions5
- Assessments6
- Risks and controls6
- Control testing5
- Findings and remediation6
- Review and evidence5
- Shared and settings1
- Policy acknowledgements
Policy version attestation and publish tracking.
Linked to Assessments, Organizations - Review decisions
Independent reviewer decisions on a submitted revision.
Linked to Assessments, Team members - Assessments
Period-scoped control testing engagements.
Linked to Organizations, Team members, Business units - Organizations
Legal entities operating policies under this governance program.
- Operation receipts
Idempotent records of guarded workflow operations.
Linked to Assessments
- Assessments
Period-scoped control testing engagements.
Linked to Organizations, Team members, Business units - Assessment tests
Individual control tests performed under an assessment.
Linked to Assessments, Controls - Business units
Operating units that own risk and are assessed.
Linked to Organizations - Organizations
Legal entities operating policies under this governance program.
- Team members
Named people with governance roles inside an organization.
Linked to Organizations, Users - Findings
Control failures and exceptions raised by testing.
Linked to Assessments, Controls
- Risks
Assessed risks with likelihood and impact on a named scale.
Linked to Business units, Team members - Controls
Controls that mitigate a risk.
Linked to Risks, Team members - Business units
Operating units that own risk and are assessed.
Linked to Organizations - Team members
Named people with governance roles inside an organization.
Linked to Organizations, Users - Assessment tests
Individual control tests performed under an assessment.
Linked to Assessments, Controls - Findings
Control failures and exceptions raised by testing.
Linked to Assessments, Controls
- Assessment tests
Individual control tests performed under an assessment.
Linked to Assessments, Controls - Assessments
Period-scoped control testing engagements.
Linked to Organizations, Team members, Business units - Controls
Controls that mitigate a risk.
Linked to Risks, Team members - Record attachments
Uploaded evidence files linked to an assessment.
Linked to Assessments, Team members - Findings
Control failures and exceptions raised by testing.
Linked to Assessments, Controls
- Findings
Control failures and exceptions raised by testing.
Linked to Assessments, Controls - Corrective actions
Remediation work assigned against a finding.
Linked to Findings, Team members - Retests
Independent retest of a remediated finding.
Linked to Findings, Team members - Assessment tests
Individual control tests performed under an assessment.
Linked to Assessments, Controls - Controls
Controls that mitigate a risk.
Linked to Risks, Team members - Assessments
Period-scoped control testing engagements.
Linked to Organizations, Team members, Business units
- Review decisions
Independent reviewer decisions on a submitted revision.
Linked to Assessments, Team members - Record attachments
Uploaded evidence files linked to an assessment.
Linked to Assessments, Team members - Operation receipts
Idempotent records of guarded workflow operations.
Linked to Assessments - Assessments
Period-scoped control testing engagements.
Linked to Organizations, Team members, Business units - Policy acknowledgements
Policy version attestation and publish tracking.
Linked to Assessments, Organizations
Keys and references
An assessment tests record points to its parent Assessments record and its Controls record. Findings point to the assessment and control, then corrective actions and Retests point to the finding. Policy acknowledgements, review decisions, record attachments and operation receipts point back to Assessments. Team members provide named owners, reviewers and uploaders. Keep these references intact when importing historical records.
Migration order
- Import Organizations, Users, team members and business units with stable identities.
- Import Risks and Controls, including their owners and effective dates.
- Import Assessments and their assessment tests.
- Import Findings, corrective actions and Retests.
- Import policy acknowledgements, review decisions, record attachments and operation receipts with their parent links.
Set up Policy Management System your way.
Start free, then use Proto to change fields, steps and approvals before your team goes live.