Source: https://atomic-works-test.docs-staging.pageloop.ai/monitors/governance-and-compliance-monitors/readme

# README

# Governance & Compliance Monitors

The **Governance & Compliance Monitors** section helps you track organisational and policy-level controls that are not directly tied to cloud infrastructure or user identity providers. These checks typically align with:

- **Risk governance**
- **Policy enforcement**
- **Compliance program oversight**

They are designed to ensure that your organisation follows a structured, repeatable approach to identifying risks, assigning responsibilities, and maintaining up-to-date security documentation.

---

#### What does Sprinto monitor here?

Sprinto automatically evaluates whether your organisation is:

Check TypeDescriptionPeriodic Risk AssessmentChecks if your Risk Register is updated regularly and new risks are assessed.Risk Owner AssignmentVerifies if each documented risk has a designated owner.Risk Treatment UpdatesDetects whether mitigation plans or accepted risks are outdated.Policy Acknowledgment(Planned) Tracks if teams have acknowledged key policies in Sprinto.

---

#### Key Checks and How to Resolve

**1. Resolve Sprinto Check for Periodic Risk Assessment**

- Go to: `Risk Register` in Sprinto
- Update stale risks or add new ones
- Assign owners and update statuses
- Upload evidence via the Risk Register or as supporting docs

---

#### Who is responsible for these checks?

RoleResponsibilityCompliance OfficerCoordinates the overall risk assessment processRisk OwnersMaintain individual risks and mitigation progressInfosec / GRC TeamsProvide oversight, alignment with frameworks, and reviewsSprinto AdminUploads evidence and updates the platform accordingly

---

#### Evidence Examples

- Screenshots of updated risks in Sprinto
- PDF summary of your latest risk workshop
- Uploaded trackers showing risk prioritisation
- Audit logs of changes to risk entries

---

#### Upcoming Additions (Coming Soon)

- Policy acknowledgment tracking
- Policy-to-risk mapping monitors
- Escalation workflows for overdue risks

---

#### Glossary

TermDefinitionRisk RegisterA list of known risks, their impact/likelihood, and current statusRisk OwnerThe person responsible for managing or mitigating a particular riskTreatment PlanStrategy for accepting, mitigating, or transferring a risk