The obligations that slip
Every security and compliance function carries a long tail of recurring work. Typical examples include:
- Access reviews — quarterly user and privileged access recertification.
- Audits and certifications — ISO/IEC 27001 surveillance and recertification audits, SOC 2 periods, regulatory submissions.
- Renewals — TLS certificates, domain names, licences, cyber insurance, support contracts.
- Policy and standard reviews — annual review and re-approval of the document set.
- Testing — disaster recovery and incident response exercises, penetration tests, backup restores.
- Third parties — supplier assessments and contract reviews on a risk-based cycle.
- Reporting — monthly KPI packs, committee papers and board updates.
Individually, each is simple. Together, they form a calendar that no single person can hold in their head — especially when people change roles.
What a good tracking system needs
One list, owned items. Every obligation has a single named owner. Shared ownership is how deadlines slip.
Repeat cycles, not one-off tasks. An access review is not a task; it is a cycle. When one instance is done, the next one should appear automatically with the right due date.
Reminders with lead time. A reminder on the due date is too late for an audit. Set reminders relative to the effort: weeks ahead for an audit, days for a review, a month for a certificate that needs procurement.
Categories that match how you report. Group obligations by area — audits, access reviews, renewals, third parties — so you can show a committee what is overdue in each.
Visibility for the lead. The team lead needs one view of who has what overdue, due this week and open, and a quick way to chase.
Templates. Most obligations repeat across organisations. Starting from a template — "quarterly access review", "annual policy review" — saves setup time and keeps naming consistent.
Spreadsheet, GRC platform or something in between?
Spreadsheets work until nobody opens them; they do not remind anyone. Full GRC platforms handle obligations well but are heavy to buy, configure and maintain, and often sit with a central compliance team rather than the people doing the work. Many security teams sit in between: they need a lightweight, shared deadline board with recurring items, reminders by email or messaging, and a lead's overview — without a six-month implementation.
A simple routine that works
- List every recurring obligation once, with its owner, cycle and next due date.
- Set reminder lead times by effort, not by habit.
- Review the board weekly: overdue first, then the next seven days.
- Record completion with a note or evidence link, and let the next cycle schedule itself.
- Report counts by category to your governance forum each month.