Control Attestation

[gourav_aggarwal]

Once Respondent says yes in attestation, control become compliant and then move to review state. Is it possible that control status will become compliant only after reviewer approves it and move it to monitor state ?

[Rafael Batistot]

Hi @gourav_aggarwal  

By default:

• When a respondent answers Yes in an attestation, the control’s status flips to Compliant.
• The record then goes to the Review state, where a reviewer just validates.

But your requirement is:

The control should only be marked Compliant after the reviewer approves (i.e., when it moves into the Monitor state).

Answer: Yes, it is possible, but you’ll need to adjust the workflow or use scripts/business rules.

1. Modify the Attestation Workflow
   
• Out-of-the-box, the workflow updates control.status (or control.test_result) right after the respondent answers.
• You can customize the workflow so that instead of updating the control right away, the system just stores the response.
• Then, in the Review → Monitor transition, you update the control to Compliant if the reviewer approves.

[gourav_aggarwal]

Thank you Rafael but do you think is it wise or best practice to change this core behavior or can have any impact in future or any other place ?

[Rafael Batistot]

@gourav_aggarwal 

Technically yes, you can delay compliance until after review. But from a best practice / upgrade safety perspective, it’s usually better to keep OOB behavior and add supplemental statuses or reports to show whether compliance has been validated. That way you get the governance you want without fighting the platform.