Periodic reviews and revisions

1) Purpose and principles

Periodic Reviews (Periodic Reviews) is a regulated cycle of reviews that confirms the relevance of policies, the correctness of access, the effectiveness of controls and readiness for audit.

• Calendar and predictability: fixed windows and deadlines.
• Risk orientation: criticality and KRI priorities.
• Automation-first: maximum auto-collections and auto-checks.
• Evidence by design: evidence is generated automatically and invariably (WORM).
• One owner: Each revision has an owner, an SLA, and an escalation plan.

2) Types of periodic reviews (portfolio)

3) Roles and RACI

(R — Responsible; A — Accountable; C — Consulted; I — Informed)

4) Annual calendar (example template)

Monthly: CCM controls, DSAR SLA, cloud drift/encryption reports, waiver hygiene.
Quarterly (Q1/Q2/Q3/Q4): IAM re-cert, Risk Register, DR exercises, Audit dry-run, retention/deletions.
Annually: complete revision of policies/procedures, VRM reviews of critical providers, BIA (business impact), audit/certification plan.

5) Process (SOP) of any revision

1. Initiation: revision card (scope, goals, criteria, deadlines, owners).
2. Data collection: auto-uploads/dashboards, evidence showcase, samples.
3. Checks and tests: checklist, pass/fail, severity of deviations.
4. CAPA/remediation: gap list with owners and deadlines, compensatory measures.
5. Upgrade and fixation: solution protocol, hash receipts, WORM archive.
6. Communication: one-pager + tasks in ITSM/GRC; escalation by SLA.
7. Retrospective: lessons, updating standards/templates.

6) Checklist templates

6. 1 Policies/Procedures

• Relevance of regulatory references and terms
• Measurability control statements
• Linking to SOP/Standards and CCM Rules
• Localizations/addendums synchronized
• Changelog and Version, Committee Update

6. 2 IAM re-cert

• Full list of active rights and owners
• SoD conflicts, orphan accounts, JIT exceptions
• Evidence of revocation/demotion
• Vendor Accesses and SSO Federations
• Re-Qualification Protocol and Delinquency Metrics

6. 3 VRM

• Current SOC/ISO/PCI reports, scope and exceptions
• SLAs/Incidents/Credits for the period
• Sub-processors and data locations - no drift
• Gap list and remediation status
• Exit plan and confirmation of mirror retention

6. 4 Retension/Legal Hold

• TTL violations = 0 critical
• Deletion Reports + Hash Summary
• Active Legal Hold - Reasons, Dates, Owners
• Mirror retention in providers
• DSAR logic intact

6. 5 DR/BCP

• RTO/RPO Test and Sample Recovery
• Communication playbooks and on-call
• Exercise and CAPA Results
• Vendors participated/confirmed readiness
• Documented post-mortem

7) Revision Portfolio Metrics and SLOs

On-time Review Rate:% of audits completed on time (target ≥ 95%).
Evidence Readiness:% revisions with full set of artifacts (100% target).
CAPA On-time:% of remediations closed by SLA (by severity).
Repeat Findings: proportion of repeated comments in 12 months (trend ↓).
Access Hygiene: share of obsolete rights after re-cert (target ≤ 2%).
Vendor Certificate Freshness:% of current certificates from critical providers (100% goal).
Audit-Ready Time: time to collect the "audit pack" after the audit (≤ 8 hours).

8) Dashboards (minimum set)

Calendar View: Map of revisions by quarter with SLAs/delinquencies.
Review Pipeline: статус (Planned → In Progress → CAPA → Closed).
Findings & CAPA: open/expired, owners, severity.
IAM Hygiene: orphan/SoD/JIT exceptions, trends.
VRM Heatmap: risk rate providers, certificates, incidents.
Retention & Hold: TTL violations, removal volumes, active hold.
Audit Readiness: completeness "by button," hash package anchors.

9) Artifacts and storage

Revision protocol (agenda, conclusions, decisions, owner/due).
List of checks/samples and their results (pass/fail).
Gap list and CAPA with dates and success metrics.
Hash receipts of uploads and reports; WORM/Object Lock.

Updated policy/procedure versions and mapping to Controlling

10) Exception management (waivers)

Issued for each gap identified if correction is not possible on time.
Contains reason, compensatory measures, expiration date, owner/plan.
Visible in dashboard; auto-escalation 14/7/1 day before expiration.

11) Integrations

CCM/Compliance-as-Code - Control test rules are run automatically on revision.
GRC: Audit Register, Findings, CAPA, Waivers, SLA and Reporting.
Evidence Storage: automatic archiving of all materials with hash fixation.
ITSM: tasks and escalations to system owners.
VRM: pulling up the statuses of providers/certificates.
LMS: Major Change Courses/Certifications Based on Audit Results.

12) Antipatterns

Revisions "for show" without CAPA and owners.
Lack of calendar and predictability → delays and fire mode.
Manual uploads without hash receipts and WORMs → controversial evidence.
Scope mix (policies change requirements, but SOPs/controls are not updated).
"Eternal" waivers with no expiration date and no compensation.
No link to risk appetite/committee - decisions don't scale.

13) Maturity model (M0-M4)

M0 Hell-hoc: irregular checks, reports in Excel, without owners.
M1 Scheduled: calendar and basic checklists, storage of artifacts.
M2 Managed: GRC registry, dashboards, SLA/escalation, WORM archive.
M3 Integrated: JMA/ascode, auto-evidence, dry-run button audit.
M4 Continuous Assurance: forecast KRIs, auto-rescheduling, end-to-end CAPA risks → CAPA → revisions.

14) Related wiki articles

KPIs and compliance metrics

Risk-Based Audit (RBA)

Continuous Compliance Monitoring (CCM)

Storage of evidence and documentation

Logging and Audit Trail

Compliance Policy Change Management

Due Diligence and Outsourcing Risks

Risk Management and Compliance Committee

Total

Periodic reviews and revisions transform compliance from a "problem response" to a transparent pipeline of improvements: a fixed calendar, automated inspections, quality artifacts, timely CAPAs, and predictable readiness for any audits.