The Compliance Health section brings ControlMap compliance data into a Lifecycle Manager Deliverable. Use it to review a client's compliance health, risks, framework progress, and outstanding work.

Who can use this feature?

Users who can create or edit the client's Deliverables.

What you'll need

• A ControlMap subscription on the same ScalePad account as Lifecycle Manager.
• The client must exist in ControlMap as the same ScalePad client. Lifecycle Manager matches clients by ScalePad client ID, not by client name.
• The ControlMap account must be in a supported region: US, EU, CA, or AU.

Lifecycle Manager reads ControlMap data through the ScalePad platform. You don't need to create an Integration Center connection or enter an API key.

Add the Compliance Health section

1. Open the client's Deliverables page. To get there, select the client, then select Engage > Deliverables.
2. Open the Deliverable. If the Deliverable is published, unpublish it before adding the section.
3. In the Sections panel, select + Add Section.
4. Select Compliance.

The section appears as Compliance Health and populates with the client's ControlMap data.

You can remove, reorder, and refresh the section like any other Deliverables section. The section doesn't have settings, content toggles, a framework picker, or PDF options.

Refresh Compliance Health data

Compliance Health data is generated from ControlMap and stored with the Deliverable. The section doesn't update live.

To pull the latest data:

1. Open the section's overflow menu.
2. Select Refresh data.

A published Deliverable keeps the figures that were available when it was generated. Trend charts show the last six months, with one data point per month.

Review the Compliance Health data

The section includes Summary, Comparison, and To do views.

Summary

The Summary view includes the following information.

• Compliance health shows the score out of 10 and ControlMap's score label. Scores of 7 or higher appear green, scores from 4 to 6.9 appear amber, and scores below 4 appear red.
• Risk level shows ControlMap's overall risk level and risk score.
• Open risks shows the number of open risks and the number of severe or high risks.

For these counts, open risks have a ControlMap status of Not Assessed, Assessment in progress, Assessed, or Needs Remediation. Closed and Remediated risks aren't included.

The Summary view also includes:

• Compliance health trend, which shows the health score by month on a 0–10 scale and the change over 30, 60, and 90 days. If ControlMap has only one reading, the section displays a message explaining that a trend appears after more history is available.
• Risk Overview, which shows open risks by month and severity: Severe, High, Medium, and Low. A decrease in risks appears in green.
• Compliance Achieved, which shows the percentage achieved by month for each framework.
• Work progress, which shows donut charts for work completed across frameworks.
• Progress History, which shows historical values for assessment, evidence, controls, action items, or documents. Only categories with available history appear in the category menu.

For Work progress, use the dropdown to switch between All frameworks and an individual framework:

• All frameworks includes Assessment Answered, Evidence, Objectives, Action Items, and Documents.
• An individual framework includes Assessment Answered and Objectives. ControlMap tracks evidence, action items, and documents for the whole client rather than per framework.

Comparison

The Comparison view compares current figures with an earlier point in time.

Use Current compared with to select one of the available options:

• Previous report compares the current data with the last time the section was successfully generated for the same client. This option appears after the section has been generated at least twice.
• 30 days ago, 60 days ago, or 90 days ago compares the current data with ControlMap's history for that period. An option appears only when the client's ControlMap history reaches back that far.

If only one comparison is available, it appears as a fixed badge. If no comparison is available, the section explains that a second compliance report is required before comparison can appear.

The comparison includes the following information:

• Risk, including open risks by severity.
• Objectives summed across frameworks.
• Action Items.

When you compare with Previous report, the comparison also includes Assessment Answered and a Risk Changes table. The table doesn't appear for the 30-, 60-, or 90-day comparisons.

The Risk Changes table includes the risk code, risk name, previous rating, current rating, and movement:

• Worsened means the rating increased, such as Low to Medium.
• Opened means the risk is new since the previous report.
• Improved means the rating decreased.
• Closed means the risk is no longer open.

Risks with no rating change aren't listed. Rows are sorted by Worsened, Opened, Improved, and Closed, then by severity.

To do

The To do view includes cards for Action Items, Documents, and Evidence. Each card shows the total and the number outstanding. Select a card to switch the board to that work type.

The board groups items into these columns:

• Not Started
• In Progress
• In Review
• Complete
• Not Applicable

ControlMap statuses map to the board as follows:

• Review, In Review, and Ready for Approval map to In Review.
• Completed, Complete, and Approved map to Complete.
• Unrecognized statuses map to Not Started.

Each card includes the code, title when available, status, linked objectives for documents, owner, and a date. The date is the due date for action items and evidence, or the review date for documents. Items without an owner show Unassigned.

Outstanding items are anything that isn't Complete or Not Applicable.

Export a Compliance Health Report

The Compliance Health section uses the new PDF renderer. The PDF matches the data shown in the section and is organized into these areas:

1. Health includes the overall score, score label, 30-, 60-, and 90-day changes, a score breakdown for Documentation, Evidence, Frameworks, and Assessment, and score history.
2. Risk includes the risk score, risk level, Severe, High, Medium, and Low counts, 30-, 60-, and 90-day changes, risk history, and the 20 highest-scored open risks.
3. Compliance includes the percentage achieved for each framework, the change since the first month shown, and framework history.
4. Progress includes Assessment Progress, Action Items Progress, Evidence Progress, Documents Progress, and Controls Progress.
5. To do includes action items by status over time.

Sections without data aren't included in the PDF.

Troubleshoot Compliance Health data

No ControlMap data appears

If the section says that no ControlMap data is available, the client exists in ControlMap but doesn't have a health score, risks, or frameworks yet.

Start the client's assessment in ControlMap, then refresh the Compliance Health section.

The section can't find the client

Make sure the client exists in ControlMap under the same ScalePad client. Lifecycle Manager matches the client by ScalePad client ID, not by name. After correcting the client link, refresh the section.

The section shows an integration error

Refresh the section. If the error continues, contact Support.

A chart or comparison option is missing

This can happen when the client doesn't have enough ControlMap history. Trends and 30-, 60-, and 90-day comparisons appear as history becomes available.

A value shows Not reported

Not reported means ControlMap didn't provide a value. It doesn't mean the value is zero, and no action is required.

The To do view has nothing to show

If a To do card says that no items are reported for the view, ControlMap doesn't have any items of that type for the client. No action is required.

Related articles

• Adding and configuring Deliverables sections
• Presenting and sharing Deliverables
• Working with Deliverables Templates
• Link ControlMap Action Items to Lifecycle Manager Pro Initiatives