Connections

• Identity. Link each active team member to the correct user account and organization before granting record access.
• Policy distribution. Choose the channel that sends an approved version to its intended audience, and define how the acknowledgment date returns to the policy record.
• Evidence storage. Agree how files are uploaded to the assessment and whether each attachment is internal or shared.

The App Administrator owns organization and membership setup. The Control Owner prepares the policy and assessment records. The Independent Assurance Reviewer decides on submitted revisions. For any external handoff, agree the operation key, expected revision and effect references so a receipt can be reconciled against records that actually persisted. Test a successful exchange and an uncertain outcome before using it in a full operating cycle.