A data office meeting may end with apparently clear actions: update a policy, complete evidence or resolve a finding. At the next meeting, the same questions return: who owns each item, and what proves completion? A file in a shared folder does not necessarily identify its obligation, current version or review outcome.

A connected tracking record is a better starting point than an attractive completion percentage. This article proposes linking each obligation to an owner, action, evidence and review status, then identifies where RMG’s published Qima capabilities can help. The model is an editorial recommendation, not an official template, an assessment guarantee or a representation of an actual product screen.

Confirm the obligation before assigning work

The data office and relevant specialists identify the source, reference, version, effective date and applicability of each obligation. Its source may be a law or regulation, an applicable control or an approved internal policy. These sources do not have equal legal force. Adding a recommended practice to a platform does not turn it into a legal obligation.

Record why each item belongs in scope and any exception or boundary needing verification. When its source changes, review the effect on open actions and evidence instead of silently replacing the reference file. Applicability remains a matter for the appropriate specialist, not solely the dashboard owner.

Connect the obligation to accountable evidence

Give the obligation an owner accountable for the outcome. Identify who performs the action, reviews its evidence and authorizes internal closure. These are proposed operating roles governed by the organization’s arrangements, not necessarily new job titles. Any combination of roles should be explicit and permitted under the relevant authorities.

Proposed record field	Question it answers
Obligation and source	What is required, under which version, and why does it apply to this scope?
Owner and action	Who is accountable, and what specific work will address the gap?
Evidence and version	Which document or operational record proves execution, and what period does it cover?
Review and status	Who checked sufficiency, and what finding and decision were recorded?
Due date and risk	When is review due, and what are the impact of delay and treatment plan?

Avoid assigning an entire department without a named accountable person, or describing the action simply as completing the requirement. A useful action specifies an inspectable output. One obligation may require several evidence items; uploading one file does not necessarily satisfy it, and file counts do not measure evidence quality.

A proposed record connects obligation, owner, action, evidence and review status; this is not a Qima interface.

Separate uploaded evidence from accepted evidence

In a hypothetical example, not a customer case or reported project, a data owner is assigned to apply an approved internal access-review procedure to a dataset. They attach the procedure and close the task. The reviewer cannot find a record showing that the review actually covered the required scope. Documenting a method is different from proving execution. The action returns for implementation evidence rather than being marked satisfied.

Define clear internal statuses such as in progress, evidence uploaded, under review and internally accepted. Record submission to an external party or external acceptance separately, only when it occurs and with a verifiable reference. These are proposed statuses, not confirmed Qima status names. Changing an internal status does not automatically establish external acceptance.

Reviewers check relevance, version, period, scope, issuer, accessibility and whether the evidence proves execution rather than intent. Record gaps in actionable terms: an uncovered scope, a missing record or a version needing an update. A bare insufficient-evidence label gives the owner little guidance for remediation.

Keep evidence current and appropriately protected

Link evidence to its version, review date and underlying obligation. Preserve a replacement history under applicable retention policy. If the procedure or operating scope changes, reassess whether linked evidence remains valid. This does not mean retaining every version forever, nor does it justify copying confidential documents into a broadly accessible workspace.

Where evidence contains personal data, Article 19 of the PDPL Implementing Regulation requires collection of the minimum necessary for the processing purpose and retention of the minimum necessary for that purpose. [1] This legal requirement is distinct from this article’s proposed record format. Use redacted evidence or restricted access where these meet the review purpose, with specialist review of legal basis, retention and disclosure. Redaction alone is not comprehensive compliance.

Proposed statuses distinguish execution, upload, review and internal acceptance; external acceptance remains separate.

Use Qima to organize work not replace professional judgment

RMG’s Qima page describes requirement-linked document management with version and access controls, role and review allocation, evidence collection, risks, notifications and reports. [2] These published capabilities can support tracking. The proposed fields, statuses and record model still need configuration confirmation with RMG; this article does not assert a specific screen or integration exists.

Start with a limited set of verified obligations. Test retrieval of the correct evidence, finding follow-up and reopening after evidence changes with both owner and reviewer. A demonstration should establish how permissions, versions and responsibilities operate in the organization’s environment. Activating a tool does not by itself establish comprehensive compliance or guarantee readiness for every assessment.

Report gaps that require a decision

A useful management report distinguishes overdue actions from evidence awaiting review, and highlights stale evidence and risks needing decisions. For any internal percentage, disclose its scope, calculation, data date and exclusions. Do not label task-closure rates official maturity scores or treat internal evidence acceptance as an external assessment outcome.

Assess maturity against the approved framework applicable to the organization, not file counts or undocumented weights. Set review frequency according to risk and change, assigning an agreed owner and due date to findings. This article provides no official weights, pass thresholds or assessment timetable.

The first step is not uploading every file at once. Select one clear obligation and create a traceable accountability and evidence chain. Discuss a scoped Qima pilot, its published capabilities and configuration needs with RMG, so the system supports decisions while evidence sufficiency remains with authorized people.