Manual · Audit & Compliance Manual

Meridian manual.

Meridian manages compliance programs, controls, evidence, audits, reporting, remediation, the trust center and SOX work.

Audience: Compliance, risk and audit leads Focus: Programs, evidence, audits and remediation

Meridian is the Cadres product for audit and compliance. Programs, controls, evidence, audits, reports and remediation tickets live in one place and link to each other.

The first three pages describe how Meridian is organized. The detailed guides after them come from the product’s operator manuals, with setup and API material removed.

Compliance Core2 sheets

MER-01 Programs, Controls & Evidence Programs, framework mapping, control ownership, evidence and risk. MER-02 Evidence & Audit Operations Evidence freshness, internal audit cycles, auditor access, questionnaires and audit reports.

Oversight & Follow-through1 sheet

MER-03 Reporting, Remediation & Trust Leadership reports, remediation tickets, program alerts, risk views and the public trust center.

Detailed Operator Guides17 sheets

MER-04 Programs Creating programs, binding frameworks, setting scope and moving a program through its statuses. MER-05 Controls Creating controls, mapping them to requirements, and managing control status and exceptions. MER-06 Control Intelligence Program health scores, gap categories, policy suggestions and duplicate-control detection. MER-07 Evidence Uploading evidence, evidence packages, freshness indicators and recertification requests. MER-08 Evidence Coverage The coverage grid, auto and manual bindings, and how to fill coverage gaps. MER-09 Gap Analysis Requirement coverage by framework, exceptions, and closing gaps before an audit. MER-10 Audit Workflow Running an internal audit cycle from planning through fieldwork, findings and completion. MER-11 Auditor Portal Inviting external auditors, setting their permissions, and revoking or re-issuing access. MER-12 Audit Reports The per-cycle Audit Report and the program-level Compliance Readiness Report. MER-13 Access Reviews Creating review campaigns, importing access data, recording decisions and scheduled reviews. MER-14 Executive Summary The program summary for leadership and board updates, and how to read its metrics. MER-15 Reporting On-demand reports, the report builder, scheduled delivery and trend analysis. MER-16 Scheduled Reports Recurring report generation, recipients, pausing, resending and delivery records. MER-17 Remediation Bridge Opening Jira, ServiceNow or GitHub tickets from findings and tracking their status in Meridian. MER-18 Trust Center Building and publishing the public trust center: content, certifications and access-controlled documents. MER-19 Risks Creating risks, assigning owners, residual scoring and updating risk status. MER-20 Risk Heatmap The 5x5 likelihood and impact grid, inherent and residual views, and the top-risks list.

Read pathWhere teams usually start

Start with Programs, Controls & Evidence to see how programs, frameworks, controls and evidence fit together.
Read Evidence & Audit Operations when you are preparing for an audit or inviting an auditor.
Read Reporting, Remediation & Trust for leadership reports, remediation tickets and the public trust center.

BridgesHow Meridian connects · optional

B-01

Portal

Portal supplies identity and access data for access reviews and access-related evidence.

B-02

Keystone

Keystone supplies business and finance data when finance or commercial controls are in scope.

B-03

Relay

Relay supplies endpoint and infrastructure data when IT operations controls are in scope.