Who can do what

A visual map of every persona in the app. Switch on Edit configuration to change what each persona should be allowed to do — your changes are saved on this device and can be exported as JSON so they can later be applied to the app's real rules.

Preparation action matrix

Template configuration, audit scoping, SME assignment and the task lifecycle (Not Started → In Progress → Submitted for Review → Verified, with Rework Requested as the only way back).

ActionMovesWalkerDRISite GDP/DI lead
Set OneQMS / Entity levelAudit Template item → level
Assign OneQMS owner, files & linksOneQMS item → central evidence
Select / de-select chapters & tasksCatalogue → audit scope
Assign SMEs to a taskUnassigned → assigned
Set or change the due dateTask → due date
Start work on a taskNot Started → In Progress
Upload attachments & reference linksTask → evidence
Add a free-text commentTask → comment thread
Submit evidence for reviewIn Progress / Rework → Submitted for Review
Verify the taskSubmitted for Review → Verified
Request rework with feedbackSubmitted for Review → Rework Requested
Ping the assigned SMEsTask → Teams + email chase
Define the entity's Audit RosterEntity → default streams & team
Create a new audit for an entityEntity → audit
Add or remove an entity favouriteChoose an Entity → working list

Verification is deliberately separated from preparation: nobody verifies evidence they produced themselves.

Rules that apply to everyone

  • SMEs act only on tasks they are assigned to — every other task opens read-only.
  • Only the Compliance seat verifies a task, and only after evidence has been submitted for review.
  • Rework always requires written feedback; it is stored on the task and shown to the SME.
  • Assignment notifications (Teams + email) are only sent on the explicit Assign action, never while picking names.
  • OneQMS / Entity level is set in Audit Template only; Audit Prep and Entity Prep display it read-only.
  • Audit Prep shows the items already in the audit; the scope itself is changed from “Select regs and tasks in scope”.
  • Every status change, verification, rework and ping is written to the task history with actor and timestamp.
Confidential — for internal use only