Compliance Reporting & Attestation Exports

The plugin gives you several ways to see how your organisation is tracking and to prove it to someone else:

a live Compliance Overview dashboard in the admin;
a per-document summary CSV;
per-user, per-document and per-campaign reports;
a front-end compliance report shortcode;
a signed attestation export (CSV or PDF) you can hand straight to an auditor.

This guide is for compliance managers, practice managers, quality leads and the auditors they work with.

All of these features are in the Free plugin. Pro adds PDF versions of the acknowledgement reports, printable acknowledgement certificates, a per-document compliance dashboard and the Evidence Pack. These additions are marked below.

The Compliance Overview dashboard

Go to Policy Management → Compliance Overview in the WordPress admin. It is the first screen in the Policy Management menu.

Only in-force documents count. Documents marked Superseded or Archived, documents that don’t require acknowledgement, and unpublished documents are left out.

KPI summary

The top of the page shows key figures at a glance:

Overall compliance — the share of required acknowledgements that are recorded and currently valid, shown as a percentage with “N of M required acknowledgements recorded and currently valid”. “Required” means one acknowledgement for each person in each document’s audience.
Pending approvals — document versions waiting for owner sign-off, with Review pending versions →
Documents past review cycle — published documents whose Next Review Date has passed, with View overdue documents →, which opens a filtered documents list
Expiring soon (30 days) — acknowledgements that expire within the next 30 days
Already expired — acknowledgements that have passed their expiry date

If no document requires acknowledgement yet, the overall figure shows No data yet rather than 100%. Instead of the dashboard, you see a short getting-started checklist with Create your first document and Open Settings buttons.

Compliance by risk tier

A table showing, for each Risk tier (Critical, High, Medium, Low, Unrated), the number of Documents, Acknowledged / Required and the Compliance rate. This way, a gap on a Critical policy is never hidden inside a good overall number. The tier comes from each document’s Risk Rating in its Compliance & Status panel.

Compliance by role

A table showing each WordPress Role with its Acknowledged count, Required count and Rate. It is based on each role’s current members and the documents that target that role. If your carers are at 60% but your managers are at 98%, you know where to focus follow-up.

Expiring and expired

Acknowledgements expiring soon — the User, Document, Version, Acknowledged date and Expires date for acknowledgements expiring in the next 30 days. The 25 soonest are listed.
Already expired — acknowledgements past their expiry date that haven’t been renewed. The 25 most recent are listed. These are the records an auditor would flag.

People who can manage acknowledgements see a Send reminder button on each row. The button changes to “Reminder sent ✓” once the email goes.

Campaign roll-up

If you use acknowledgement campaigns, a Campaign completion table lists each campaign with its number of Documents, Acknowledged and Pending counts, Completion rate and Due Date (marked overdue when passed), plus View report →.

Export CSV

The Export CSV button at the top of the page downloads a per-document summary with these columns:

Column	Meaning
Document ID	The document’s WordPress ID
Document Title	Its title
Required Users	People in its audience
Acknowledged	How many hold a currently valid acknowledgement
Compliance %	Acknowledged ÷ required, to one decimal place
Expiring (30 days)	Acknowledgements expiring in the next 30 days
Overdue	People still outstanding
Status	Fully Compliant (100%), Partially Compliant (70% to under 100%) or Non-Compliant (under 70%)

Cells are protected so they can’t run as spreadsheet formulas when opened.

How fresh are the numbers?

Figures are cached for up to 5 minutes. They refresh straight away when someone acknowledges, when acknowledgements are invalidated by a new version, and when a version is submitted, approved or rejected. The footer shows when the figures were last refreshed.

Who can see it

Administrators and the Policy Auditor role can open the Compliance Overview and download its CSV. Only people who can manage acknowledgements (administrators by default) see the Send reminder buttons.

The dashboard widget

A Dantian Policy Management — Compliance Snapshot widget appears on the main WordPress Dashboard (the screen you see when you log in) for anyone who can view the Compliance Overview. It shows four counts, each linking to the relevant screen:

documents overdue for review
versions pending approval
acknowledgements expiring within 30 days
users with outstanding acknowledgements

Each count is highlighted when it is above zero. With Pro active, the first two link to the Pro Document Compliance screen instead of the Free documents list and Pending Approvals screen.

Attestation export — the auditor report

The attestation export is a signed record of acknowledgements with full provenance. It is what you give an external auditor, regulator or internal audit team as evidence that a policy was distributed and acknowledged.

What the report contains

Each row in the CSV has these columns:

Column	Contents
`ack_id`	The acknowledgement record’s ID
`user_login`, `user_display_name`, `user_email`	Who acknowledged
`role_at_ack`	Their role at the moment of acknowledgement, not their current role
`document_id`, `document_title`, `document_version`	What they acknowledged
`content_hash_at_ack`	The SHA-256 content hash of that version. It is empty for older “legacy” acknowledgements made before content hashing.
`acknowledged_at_utc`, `expires_at_utc`	When they acknowledged and when it expires, in UTC
`ack_source`	How it was recorded: ui (the user clicked Acknowledge), proxy (an administrator acknowledged on their behalf), import, attestation (recorded automatically when the owner signed off a review — see Version Control & Owner Approvals) or legacy
`delegated_by`, `delegation_reason`	For proxy acknowledgements: who acted and why
`dwell_seconds`, `scroll_pct`	Reading time and how far they scrolled, when read-time capture was on
`comprehension_score`, `comprehension_question_count`, `comprehension_questions_json`, `comprehension_answers_json`	Comprehension quiz result, plus the questions and answers
`ip_address`	IP address, when IP recording was on

🔒 Pro feature — requires the Pro plugin. With Pro’s reading-time enforcement, the CSV also includes min_dwell_required and min_scroll_required: the minimum reading time and reach that were enforced when each acknowledgement was made. Free exports leave these two columns out.

The content hash on each row is the key piece of evidence. Together with the version snapshots kept by the plugin, it shows exactly which content each person acknowledged.

Generating an export

Go to Policy Management → Acknowledgements and open the Attestation Export tab.
Choose the Format: CSV (.csv) or PDF (.pdf).
Optionally filter the records:
- Acknowledged from — defaults to 30 days ago. Clear it for no lower limit.
- Acknowledged to — inclusive. Leave blank for no upper limit.
- Document — one document, or All documents.
- Role at acknowledgement — one role, or Any role.
- Source — UI (user clicked acknowledge), Proxy (admin delegated), Import (bulk CSV), Legacy (pre-provenance back-fill), or Any source. There is no separate option for acknowledgements recorded by a review sign-off. They are included when you choose Any source.
Click Generate attestation export.

The file downloads straight away and is named dpma-attestation- followed by the date and time.

Each export is limited to 5,000 rows. If your filter would return more, the export is marked INCOMPLETE. Narrow the date range or choose a single document and export in parts.

Export integrity signature

Both formats carry an export integrity signature, which is a SHA-256 of the CSV content. To check that a PDF hasn’t been altered, an auditor can regenerate the CSV with the same filter and confirm the signatures match.

CSV format

The CSV opens in Excel, Google Sheets or any spreadsheet application. After the data rows, a short trailer of lines starting with # records when the export was generated (UTC), the plugin version, your site address and organisation name, the filter used, the row count, whether the export is complete, whether personal columns were withheld, and the export_signature_sha256. Cells are protected against spreadsheet formula injection.

PDF format

The PDF has a Compliance Attestation Export heading, with when it was generated, the plugin version, the filter used and the row count. The records follow in a table with these columns: User, Role at ack, Document, Version, Content hash (first 12 characters), Acknowledged (UTC), Reading record, Comprehension and Source. The export integrity signature appears at the end. The PDF uses your PDF Export settings, such as logo and organisation details. If PDF support isn’t available on your server, you see “PDF support is not available on this server. Use CSV export instead.”

🔒 Pro feature — requires the Pro plugin. The Evidence Pack bundles an attestation export with other audit evidence in a single ZIP — see Per-document compliance dashboard (Pro) below.

View-only users

People who can view acknowledgements but not manage them, such as the Policy Auditor role, can generate exports too. For them, the email address, IP address and quiz answer columns are left blank, and the export states that these were withheld. Names, roles, versions, content hashes and timestamps are always included.

Keeping reports long-term

Attestation exports are point-in-time snapshots. Generate and archive them regularly, for example at the end of each financial year, after each audit, or after a significant policy change. The plugin automatically removes acknowledgement records older than 7 years in a weekly clean-up. If you need evidence for longer than that, keep your own exports.

Per-document acknowledgement log

To check who has acknowledged a specific document without running a full export:

Go to Policy Management → Acknowledgements and open the Acknowledgement Logs tab.
Use Filter by Document to pick the document (or All Documents) and click Filter.
The log lists each acknowledgement with the User, Document, Version, Acknowledged At, Expires At, Reading record and IP Address. Proxy acknowledgements show “Delegated by …”.

The log shows the 500 most recent acknowledgements for your filter. For a full picture of who in the audience has and hasn’t acknowledged, use the Policy report on the Reports tab (below).

Per-user acknowledgement history

To see everything one person is required to acknowledge:

Go to Policy Management → Acknowledgements and open the Reports tab.
Choose the User report type and select the user.
Click Generate Report.

The User Acknowledgement Report shows acknowledged and pending totals and each required document with its status, version, dates and comprehension score. It shows a Reminders opted out badge if the person has turned off reminder emails. Their acknowledgements are still required.

Click Export CSV to download the user’s status as a spreadsheet. The columns are Document ID, Document Title, Version, Status, Acknowledged At, Expires At, Comprehension Score and Ack Source. Exporting this CSV needs permission to manage acknowledgements.

Compliance reports in the admin

Policy Management → Acknowledgements has four tabs: Overview, Acknowledgement Logs, Reports and Attestation Export. On the Reports tab, choose a Report Type:

User — every required document for one person, with Export CSV
Policy — everyone in one document’s audience, with acknowledged and pending counts and a completion rate
Campaign — everyone in a campaign’s audience and the documents they still need to acknowledge, with a Send reminders button

The Outstanding Users Report link next to the report types lists everyone who currently has outstanding acknowledgements, with a View Report link for each person.

Auditors and other view-only users can open these reports but can’t send reminders or acknowledge on someone’s behalf.

Front-end compliance report: `Please log in to view this compliance report. Log in`

To show one document’s compliance status on a page, for example on an intranet page for managers, add:

Please log in to view this compliance report. Log in

Attribute	What it does	Default
`document_id`	The document to report on (required). Find the ID in the address bar when editing the document.	—
`roles`	Comma-separated role names to limit the report to, e.g. `roles="nurse,carer"`. Only roles in the document’s audience are used.	All of the audience
`limit`	Maximum number of people listed	200

The report shows a Compliance Report — {document} heading and a table of User, Status, Acknowledged On, Expires and Version. Status is one of:

Acknowledged — a currently valid acknowledgement exists
Pending — the person has never acknowledged
Expired — their acknowledgement has passed its expiry date
Outdated — they acknowledged an earlier version

Only site administrators can see the report. Logged-out visitors see a login prompt. Other logged-in users see “This report covers the whole organisation and is limited to compliance administrators”, with a link to their own acknowledgements where such a page exists. If document_id is missing, page editors see a message explaining how to add it.

PDF acknowledgement reports and certificates (Pro)

🔒 Pro feature — requires the Pro plugin.

With an active Pro licence, the Acknowledgements screen gains PDF exports:

Reports tab → User report → Export to PDF downloads a User Acknowledgement Report. It shows the person’s name and email, when it was generated, acknowledged, pending and total-required counts, and the average comprehension score where quizzes were used. A table lists Document, Status, Version, Acknowledged At, Expires At and Comprehension.
Reports tab → Policy report → Export to PDF downloads a Document Acknowledgement Report, with acknowledged and pending counts and a completion rate. A table lists User, Email, Role, Status, Acknowledged At and Expires At for everyone in the document’s audience.
Acknowledgement Logs tab adds a checkbox to each row and an Export PDF button on each row. Tick several rows and click Export Selected as PDF to download them together. Each selected acknowledgement becomes a Document Acknowledgement Certificate showing the person’s name and email, who delegated it and why (for proxy acknowledgements), the document, version, acknowledged and expiry dates, IP address (if recorded), and the acknowledgement statement they agreed to. A line at the foot of each certificate records when and by which site it was generated.
The Overview tab adds a shortcut: Export acknowledgement logs as PDF →.

Certificates use PDF Header Text and PDF Footer Content (Acknowledgement Certificates) from Settings → PDF Export. The footer accepts the placeholders {title}, {site}, {date} and {user}.

The PDF opens in a new tab. If nothing appears, check your browser’s pop-up blocker. Only people who can manage acknowledgements can create these PDFs, so the Policy Auditor role can’t. On Free, these buttons don’t appear. The CSV exports above are available instead.

Per-document compliance dashboard (Pro)

🔒 Pro feature — requires the Pro plugin.

The Pro add-on adds a Document Compliance screen: a document list focused on compliance, with:

Filters by owner, document type, regulatory framework, document status, compliance status and classification
Inline version history for each document
Bulk Edit — change governance details for several documents at once
A link to the site-wide summary on the Compliance Overview

The Evidence Pack (a tab on the Tools page) builds a single ZIP for an audit period. It contains the attestation export, a PDF of each document version (with its content hash), the per-document acknowledgement log, the list of exceptions (people in the audience who haven’t acknowledged, with any waiver reason) and a signed manifest.

For details, see Per-Document Compliance Dashboard (Pro).

The Tools page

Policy Management → Tools (site administrators only) groups import, export and maintenance utilities in a side menu with Import and Export groups.

On Free, the Tools page has:

Settings Backup / Restore — Export Settings downloads a JSON file of all plugin settings. Import Settings restores one, overwriting your current values after you confirm. This covers configuration only, not documents or acknowledgement records. Keep a settings backup alongside your attestation exports so you can show how the system was configured at the time. See Settings Reference.
File Import — turn a ZIP of Word, PDF, text or Markdown files into draft documents. See Creating and Managing Documents.
Framework CSV Import — appears when Regulatory Frameworks is enabled. See Regulatory Framework Mapping (Pro).

🔒 Pro feature — requires the Pro plugin. Pro adds Bulk Import (Bulk Import (Pro)), Bulk FAQ Import and Imported Drafts under Import, plus two Export tabs: PDF Export, which downloads a ZIP of PDFs of every published document of a chosen Document Type (optionally narrowed by Category and Tag), and Evidence Pack (Per-Document Compliance Dashboard (Pro)).

The Auditor role

If an auditor needs to review your compliance records without being able to change anything, give them the built-in Policy Auditor role.

This role can:

View the Compliance Overview (including its CSV) and the Analytics screen
See the Compliance Snapshot widget on the Dashboard
View the Acknowledgements screen in view-only mode (no reminders or acknowledging on behalf), including logs and reports
Generate attestation exports, with email addresses, IP addresses and quiz answers withheld
Read all documents, whatever their audience

The Policy Auditor role can’t create, edit or publish documents, can’t change settings, and can’t download the per-user CSV or the Pro PDF reports.

Creating an auditor user:

Go to Users → Add New User.
Create a user account for the auditor.
Set their role to Policy Auditor.
Share the login details with the auditor securely.
When the audit is complete, delete the account or change its role.

Troubleshooting

The Compliance Overview says “No data yet”. No published, in-force document requires acknowledgement yet, or the required documents have no audience. Tick Require Acknowledgement on a document and give it an audience. See The Acknowledgement System.

My attestation export is missing older acknowledgements. The Acknowledged from date defaults to 30 days ago. Clear it to include everything. If the export says it was capped at 5,000 rows, narrow the filter and export in parts.

The auditor’s export has blank email and IP columns. This is intended. View-only users receive a redacted export. An administrator can generate the full version.

The

page shows “No audience configured for this document.” The document has no audience, or the roles attribute doesn’t match any of its audience roles. Check the document’s audience, or remove the roles attribute.

Worked example: a registered training organisation prepares for an audit

Northside Training College (an RTO) has a compliance audit next month. Its compliance manager, Mei, works through the evidence:

On Compliance Overview she sees overall compliance at 91%. Compliance by risk tier shows the two Critical policies at 100%, but Compliance by role shows Trainers at 82%.
In Already expired she finds six trainers whose Student Complaints Policy acknowledgement lapsed, and clicks Send reminder on each.
She clicks Export CSV and attaches the per-document summary to her audit preparation notes.
She creates a user for the external auditor with the Policy Auditor role.
On Acknowledgements → Attestation Export, she clears Acknowledged from, sets Acknowledged to to 30 June, chooses CSV (.csv) and generates the export. She then repeats it as PDF (.pdf) with the same filter, so the two files carry the same export integrity signature.
During the audit, the auditor logs in, checks the Compliance Overview himself, and confirms a sample of content hashes against the documents’ version snapshots.

Was this helpful?