Why teams report different states for the same case

Compliance may record an action as complete while risk management keeps the risk open and a committee still awaits evidence. All three states can be valid because they answer different questions. Integration starts by defining their relationships instead of compressing them into one green percentage. The framework should show what the organization must do, what threatens its objectives, which control addresses the exposure, and who supplies and reviews evidence. A shared screen cannot resolve conflicting definitions or responsibilities.

Start with scope and an obligations register

Choose a defined process or service group for the first implementation. Record each obligation’s source, edition, clause, effective date, scope, applicability rationale and owner. Distinguish a legal requirement from a contractual commitment, internal policy and voluntary practice. The appropriate specialist must review applicability; copying a well-known framework name is insufficient. ISO 37301 provides a reference for managing and improving a compliance system [2]. It does not make this proposed model Saudi law or demonstrate organizational compliance or certification.

Use stable identifiers and traceable relationships

Assign separate identifiers to obligations, risks, controls, evidence and actions. One control may serve several obligations, while one obligation may need several controls. Preserve the mapping rationale, scope and reviewer. Avoid copying evidence into multiple records until its source becomes unclear. Link to a controlled reference with a date, scope and access permissions. The GOVERN function in NIST CSF 2.0 emphasizes context, responsibilities, policies, oversight and integration of cybersecurity risk with enterprise risk management [3]. It is guidance rather than a substitute for applicable requirements.

Separate states before designing the dashboard

An action state describes completed work; an evidence state describes availability and validity; a control test result describes what the review supports; and a risk state describes residual exposure under the organization’s methodology. Uploading a file does not establish control effectiveness, and completing a task does not close a risk. Use explicit evidence states such as requested, submitted, incomplete, accepted for the stated scope and expired. Define who may accept evidence or a risk, with appropriate separation of execution and review and management of conflicts of interest.

An illustrative access review example

Suppose an organization wants to track an internal system access review under its approved policy. The internal obligation links to the risk of retaining unnecessary access and to a periodic review control defining the account scope. The system owner prepares the list and justifications, and the authorized reviewer examines the results. Evidence records its extraction date, scope and review decision. An account without justification generates an action with an owner and due date. The case still needs treatment until execution is verified. This is a fictional operating example, not a client case, an official control text or a recommendation for a universal review frequency.

Define escalation and closure decisions early

Escalation should reflect the impact of delay, obligation sensitivity and due date rather than email volume alone. Present the committee with the decision needed, accountable person, blocker, residual risk, treatment options and approved timing. A label saying overdue is insufficient. Closure records what was done, who verified it, the evidence and limitations. Reopen review when scope or obligations change or a control fails. The organization can monitor unowned cases, expired evidence and repeatedly returned actions, while defining each measure before reporting it.

Check Saudi requirements according to applicability

ECC 2-2024 identifies its scope, including government agencies and their affiliated companies and entities, and private entities owning, operating or hosting critical national infrastructures. It also includes requirements on documented responsibilities and review of policies and controls [4]. This does not mean every framework applies to every organization. Link obligations to the official text and edition and obtain specialist review of sector, scope and exceptions. Keep that determination separate from the proposed tracking model: a tool records follow-up rather than granting an automatic compliance determination.

How to start with Ahkam without digitizing disorder

The current Ahkam page describes framework, policy, risk, compliance and audit management, including links between controls, treatment plans and roles [1]. Start with a small scope, clean the records and assign identifiers and owners, then test a complete case from obligation to decision and action closure. Verify permissions, change history, evidence handling and your organization’s requirements before expanding. Discuss an appropriate governance, risk and compliance tracking model with the Rinad Al Majd team, and request a demonstration based on your actual scenario rather than only a feature list.