Compliance Manager Guide
This guide is for Compliance Managers — the people responsible for monitoring policy acknowledgement rates, answering audit evidence requests, and keeping the organisation’s document library within its review cycles. Your work happens in the plugin’s compliance and reporting screens under Policy Management.
This guide can be customised to reflect your organisation’s compliance framework (ISO 27001, HIPAA, NDIS, etc.).
Before you start: your access
There is no built-in “Compliance Manager” role. What you can do depends on which WordPress role your administrator gives you:
| Your account | What you can do |
|---|---|
| Administrator | Everything in this guide, including sending reminders, acknowledging on someone’s behalf, user CSV reports, and the Pending Approvals queue |
| Policy Auditor | View-only: the Compliance Overview (including its CSV export), the Acknowledgements screen in view-only mode, the Attestation Export, and Analytics. You cannot send reminders, act on behalf of users, or approve versions. Some personal details (email, IP address, quiz answers) are withheld from your exports |
| Another role adjusted with a role-management plugin | Whatever your administrator has granted. Ask them which of the screens below you can use |
Steps that need Administrator access are marked (Administrator) below.
What you see in the admin panel
When you log in to wp-admin, the Policy Management menu gives you:
- Compliance Overview — the organisation-wide compliance summary
- Acknowledgements — who has and hasn’t acknowledged, reports, and the attestation export
- Pending Approvals (Administrator) — versions waiting for owner approval
- Analytics — search and reading activity
- Settings and Tools (Administrator)
🔒 Pro feature — with the Pro add-on you may also see Evidence Pack, Calendar (compliance calendar), Coverage & Gaps, Waiver Register (Administrator), and Document Compliance (Administrator).
Your weekly workflow
Start of the week: check the Compliance Overview
Go to Policy Management → Compliance Overview and review:
- Overall compliance — the share of required acknowledgements that are recorded and currently valid
- Pending approvals — versions waiting for owner sign-off
- Documents past review cycle — documents whose review date has passed
- Expiring soon (30 days) and Already expired — acknowledgements that need renewing
- Compliance by risk tier, Compliance by role, and Campaign completion — where the gaps are concentrated
Note any documents, roles, or campaigns with low compliance and prioritise follow-up.
Mid-week: follow up on outstanding acknowledgements
The plugin sends reminder emails automatically on the schedule your administrator set. For compliance-critical documents you can also act directly (Administrator):
- On the Compliance Overview, click Send reminder next to anyone in the Expiring soon or Already expired lists
- On Acknowledgements → Overview, open a document to see who is still pending. Select people and click Send Reminder to Selected, or Schedule… the reminders for a later date and time
- On Acknowledgements → Reports, run the Outstanding Users Report to see everyone with outstanding acknowledgements, or a Campaign report and click Send reminders for a whole campaign (once per day per campaign)
Staff can opt out of repeat reminder emails in their profile. A user report flags this as Reminders opted out. Their acknowledgement is still required, so follow up another way.
End of the week: review pending approvals
If you are an Administrator, check Policy Management → Pending Approvals. If you are a document owner yourself, approve from the email you received or from your organisation’s Pending Approvals page.
Adjust this schedule to match your organisation’s compliance reporting cycle.
Generating audit evidence
When an auditor asks for evidence of policy distribution, use Policy Management → Acknowledgements.
Attestation Export (CSV or PDF)
On the Attestation Export tab, choose a Format (CSV or PDF), a date range (Acknowledged from / Acknowledged to — the default is the last 30 days), and optionally a Document, Role at acknowledgement, and Source (user clicked acknowledge, admin acknowledged on their behalf, bulk import, or legacy record). Then click Generate attestation export. Each row includes:
- The user and their role at the moment they acknowledged
- The document and version acknowledged
- The SHA-256 content hash of that version
- The acknowledgement time (UTC)
- The reading record and comprehension result, where captured
- The source of the acknowledgement
The CSV and PDF carry a shared export integrity signature, so an auditor can confirm the two files match. Exports have a row limit — if you hit it, narrow the date range or choose a single document.
Reports
On the Reports tab, choose a report type:
- User — every required document for one person, with status, version, dates, and quiz scores. Export CSV is available (Administrator)
- Policy — every person in one document’s audience, acknowledged or pending, with a completion rate
- Campaign — completion across a named group of documents (for example an onboarding pack)
- Outstanding Users Report — everyone who still has acknowledgements outstanding
Compliance Overview export
Export CSV on the Compliance Overview gives one row per document: required users, acknowledged, compliance %, expiring, overdue, and status.
🔒 Pro feature — requires the Pro plugin.
Policy Management → Evidence Pack builds a single ZIP for an auditor: the attestation CSV and PDF, a PDF of each document version, lists of staff who have not acknowledged, and a manifest with integrity checksums. Pro also adds PDF export of acknowledgement logs and user reports, and scheduled weekly or monthly compliance report emails to the people you choose.
Understanding acknowledgement records
Each acknowledgement record captures:
- Who — the WordPress user account
- Which version — the exact document version acknowledged
- When — the time, stored in UTC
- What role — the user’s role at that moment (preserved even if their role changes later)
- Content hash — the SHA-256 fingerprint of the document content at that version
- How — the source: the user clicked acknowledge themselves, an administrator acknowledged on their behalf (with a recorded reason), or a bulk import
Depending on settings, a record may also hold the user’s IP address, their reading time and reach, and their comprehension quiz answers.
This means you can answer “did Jane acknowledge the April version of the Infection Control Policy?” long after the document has been updated.
Watching for documents due for review
The Documents past review cycle card on the Compliance Overview shows documents whose Next Review Date has passed. For each one:
- The owner receives Review Due reminder emails beforehand, if review alerts are switched on
- The document stays published — it is not unpublished automatically
- When the owner records a review (Mark reviewed and current), the next review date moves forward by the document’s review cycle
Your job is to follow up with owners whose documents are overdue for review.
Add your organisation’s escalation path here (e.g. “notify the department head after 30 days of non-review”).
🔒 Pro — Regulatory framework mapping
Documents can be tagged with regulatory framework controls in the free plugin once Regulatory Frameworks is enabled. The Pro add-on adds a Framework Library of ready-made frameworks to install, and a Coverage & Gaps page with a clause-by-clause readiness matrix (green = fully covered, amber = gaps or overdue, red = no documents mapped). Click Export Survey Packet (ZIP) to hand the matrix to an auditor. This is a fast way to prepare for an accreditation visit.
Frequently asked questions
Q: A staff member says they acknowledged a document but it shows as outstanding. Open Acknowledgements → Reports, run a User report for them, and check the status. Outdated means they acknowledged an earlier version and the document has since changed enough to need a new acknowledgement. Expired means their acknowledgement has lapsed. If there is no record at all, ask them to open the document and acknowledge again.
Q: We updated a policy. Do staff need to re-acknowledge it? Only if the change type meets your organisation’s re-acknowledgement level (by default, major changes). Patch and minor changes leave existing acknowledgements valid.
Q: Can I see what version of a document a user acknowledged? Yes. The attestation export, the Acknowledgement Logs tab, and the User and Policy reports all show the version for every record.
Q: Can I see who has NOT acknowledged a document? Yes. Run a Policy report for the document, or open it from Acknowledgements → Overview to see the pending users.
Q: Why don’t the numbers change straight away? The Compliance Overview refreshes automatically when an acknowledgement is recorded, and is otherwise cached for up to five minutes.