Guide for Policy Auditors

This guide is for external auditors and compliance reviewers who have been given read-only access to your organisation’s policy management system to conduct an audit, compliance review, or evidence check.

---

Getting started

You have been given a WordPress login to access the policy management system. Your account uses the Policy Auditor role, which gives you read-only access to compliance records and lets you read every governed document.

Your access at a glance

With the Policy Auditor role you can:

• View the Compliance Overview and export it to CSV
• View acknowledgement records for all staff on the Acknowledgements screen (view-only)
• Generate and download the Attestation Export (CSV or PDF)
• View Analytics (search and reading activity)
• Read every published document on the organisation’s site, whatever its audience, including its version history

You cannot create, edit, or delete documents, approve versions, send reminders, acknowledge on anyone’s behalf, or change settings. You also cannot open documents in the WordPress editor — you read them on the site, as staff do. Some personal details are withheld from your exports (see below).

Logging in

1. Go to the WordPress admin login page (usually yoursite.com/wp-admin/)
2. Enter the username and password provided by your contact at the organisation
3. After login you will land on the WordPress Dashboard — look for Policy Management in the left-hand admin menu

---

Conducting a compliance review

Step 1: Check the Compliance Overview

Go to Policy Management → Compliance Overview. It shows:

• Overall compliance — the share of required acknowledgements that are recorded and currently valid
• Pending approvals — document versions awaiting owner approval
• Documents past review cycle — documents whose review date has passed
• Expiring soon (30 days) and Already expired acknowledgements
• Compliance by risk tier, Compliance by role, and Campaign completion

Click Export CSV for a per-document spreadsheet: required users, acknowledged, compliance %, expiring, overdue, and status.

Step 2: Review a specific document’s compliance

1. Go to Policy Management → Acknowledgements. The screen opens in view-only mode
2. On the Overview tab, each acknowledgement-required document shows how many people are required, how many have completed, how many are pending, and its completion %. Open a document to see who is still pending
3. On the Reports tab, choose Policy and select the document for a list of everyone in its audience with their Status, Acknowledged At, and Expires At dates. Choose User to see one person’s record across all documents, or Campaign for a group of documents
4. The Acknowledgement Logs tab lists every acknowledgement record (user, document, version, acknowledged and expiry dates), filterable by document

Step 3: Review version history

1. Open the document on the organisation’s site (your contact can give you the Document Hub link, or use the links in the reports)
2. Scroll to Version History. It lists every version with its number, type (major or minor), date, author, and approver. Whether you see the description of each change depends on the organisation’s settings
3. As an auditor, you also see a summary such as “12 of 15 acknowledged · 3 pending” on each acknowledgement-required document

The full text of earlier versions is held in the plugin’s version snapshots, which only editors and administrators can open. If you need an earlier version’s content, ask your contact to export it for you.

Step 4: Download attestation evidence

To produce formal evidence of acknowledgement for an audit:

1. Go to Policy Management → Acknowledgements → Attestation Export
2. Choose the Format — CSV (.csv) or PDF (.pdf)
3. Set the date range with Acknowledged from and Acknowledged to. It defaults to the last 30 days, so widen it for a full audit period
4. Optionally narrow by Document, Role at acknowledgement, and Source
5. Click Generate attestation export

Each row includes: the user, their role at the time of acknowledgement, the document and version, the SHA-256 content hash of that version, the acknowledgement time (UTC), the reading record and comprehension result where captured, and the source (user clicked acknowledge, admin acknowledged on their behalf, bulk import, or legacy record).

The CSV and PDF share an export integrity signature, printed on the PDF. To check that a PDF and CSV match, regenerate the CSV with the same filters and compute its SHA-256 — it must equal the signature. An empty content hash means the acknowledgement was recorded before content hashing was in place.

Because your access is view-only, the user’s email address, IP address, and comprehension answers are withheld from your export. The columns are still present, so the file layout is the same as an administrator’s. Exports have a row limit; narrow the date range or document if you reach it.

---

Key features available to auditors

Compliance Overview

Policy Management → Compliance Overview — site-wide acknowledgement rates, review status, expiring and expired acknowledgements, and breakdowns by risk tier, role, and campaign. Exportable to CSV.

Acknowledgements (view-only)

Policy Management → Acknowledgements — the Overview, Acknowledgement Logs, Reports, and Attestation Export tabs. You can read everything, but you cannot send reminders or act on behalf of users.

Version history

Every document page lists its versions under Version History. Each acknowledgement record carries the SHA-256 content hash of the version that person acknowledged, so the evidence links each acknowledgement to the exact text in force at the time.

Attestation export

CSV and PDF exports cover the core evidence auditors usually ask for: who, which version, when, in what role, and a tamper-evident content fingerprint.

Analytics

Policy Management → Analytics — search activity, most viewed documents, and PDF downloads. This is useful for showing that policies are being found and read.

🔒 Pro feature — if your organisation uses the Pro add-on, you can also use:

• Evidence Pack — a single ZIP with the attestation CSV and PDF, a PDF of each document version with its content hash, lists of staff who have not acknowledged, and a manifest of integrity checksums
• Coverage & Gaps — a clause-by-clause readiness matrix for each installed regulatory framework, exportable as a survey packet
• Calendar — upcoming reviews and expiries

---

Getting help

If you cannot find the records you need or your access is not working:

1. Contact your organisation’s WordPress administrator — they manage your auditor account
2. Check the full troubleshooting guide for common issues
3. For plugin support: WordPress.org support forum