The Compliance Calendar answers one question every morning: what has to be done, by whom, and how urgent is it. It gathers three kinds of dated work into one list, keeps the dates true without anyone editing a spreadsheet, and turns each item into a task with a reminder.

Venvera Compliance Calendar page with the overdue, 7-day, 30-day and 90-day counters, the urgency and risk filters and the table of control reviews, control tests and framework obligations
The Compliance Calendar filtered to items due within 30 days - shown with sample data.

What is on the calendar

  • Control reviews. Every implemented or partially implemented requirement control has a review cadence (from the control catalogue: monthly, quarterly, every six months or yearly; controls that operate continuously are reviewed quarterly) and a review date. The first review is never scheduled sooner than 30 days after the control is implemented.
  • Control tests. Library controls carry a testing cadence, yearly by default, and a next-test date computed from the last closed test. Recording a newer test moves the date on automatically.
  • Framework obligations. The recurring duties each framework expects, 200 of them across the 22 frameworks, each with its cadence and legal basis: the filings and audits (the DORA register of information by 31 March, the ISO 27001 internal audit and management review, the NDPA compliance audit return, PCI DSS quarterly ASV scans) and the operational duties every framework text demands: policy review, access rights review (every six months under PCI DSS 7.2.4, quarterly under ISO 27001 A.5.18), security awareness training, vulnerability scanning, penetration testing, business continuity and restore tests, log review, firewall rule review, incident response exercises. Each obligation carries its own notice period from the catalogue, 14 to 120 days, so a three-yearly TLPT is announced four months ahead and a quarterly scan three weeks ahead.
  • Policy reviews. Every approved policy has a next review date (twelve months after approval by default; the frequency and the date are editable on the policy) and appears here when the review is due. Completing the review moves the date one period on.

Urgency and risk

The four counters at the top are filters: overdue, due in 7 days, due in 30 days, due in 90 days. The fifth, critical and high risk, narrows the list to items that protect a critical or high residual risk. Each control's risk level comes from the risks linked to it in the risk register (the highest residual rating wins); an obligation's level is its regulatory severity. Combine the filters: overdue items on critical risks is the list a CISO reads first. Filters live in the URL, so a filtered view can be bookmarked or sent to a colleague.

Tasks and reminders

Every night at 07:00 UTC Venvera schedules new items, and for anything due within its notice period (30 days for control reviews, tests and policy reviews; the catalogue lead time for each obligation) or overdue it creates a task for the owner (the control owner, or the person holding the responsible role under Responsibilities), sends an in-app notification and, if an admin has turned on Email reminders under Settings (off by default), one digest e-mail per person. Reminders repeat weekly while an item stays open; overdue items are flagged separately. An admin can run the same job on demand with Run now.

ℹ️
Completing the task is the signal. Mark the task done, or press Mark done on the calendar row, and the next due date moves one cadence on: the control review to its next period, the obligation to its next anchor or interval. Nothing else needs editing.

Adjusting an obligation

Administrators can change an obligation's owner or next due date, add notes, or switch an obligation off if it does not apply to the organisation (for example TLPT for an entity outside its scope). Obligations for frameworks you stop running disappear from the calendar automatically.

Recurring access reviews

The access-review obligation on the calendar says when a review is due; the access review cycle is where it is done. A cycle started with a repeat setting (monthly, quarterly, every six months or yearly) spawns its successor the moment it is completed, due one period after the previous due date, with the same scope note and a fresh snapshot of the register, so the next review is already waiting when its obligation comes round.

Where it connects

  • Tasks: calendar tasks are ordinary tasks with the calendar as their source; they sync to Jira like any other.
  • Evidence: evidence freshness is tracked separately; a control review is the moment to confirm the evidence is still current.
  • Risk register: linking risks to controls is what gives the calendar its risk filter.