Sheet MER-01 · Audit & Compliance Manual
Programs, Controls & Evidence
Programs, framework mapping, control ownership, evidence and risk.
How Meridian organizes compliance work
A program is the container for one compliance effort, such as a SOC 2 audit or a SOX ICFR program. You bind one or more frameworks to it and set its scope. Each control belongs to a program, has an owner, and maps to one or more framework requirements. Evidence is attached to controls and has a freshness date.
| Object | What you set | Where to read more |
|---|---|---|
| Program | Frameworks, scope organizations, status (Draft, Active, In Audit, Archived) | Programs |
| Control | Reference ID, owner, requirement mappings, status | Controls |
| Evidence | Target program and control, valid-until date | Evidence |
| Risk | Likelihood, impact, owner, residual score | Risks |
Archiving a program makes it read-only. Its audit cycles, findings, controls and evidence are frozen.
Control status
Meridian derives control status from the latest test result, whether a person or a connector recorded it. An operator can pin a status as a manual override. Marking a control Not Applicable goes through a scope-removal approval.
Finding gaps before an auditor does
- Gap analysis shows, per framework, which requirements are covered, partly covered, not covered or under an active exception.
- Evidence coverage shows, per control, whether current evidence or a configured connector exists.
- Control intelligence gives each program a health score, suggests policy-to-control links and flags likely duplicate controls across frameworks. It computes these from your existing mappings and does not call an AI model.
SOX programs
A program of type SOX ICFR adds tooling for Sections 302 and 404: process documentation, control testing, deficiency tracking, management attestation and escalation. It uses the same controls, evidence and audit cycles as other programs.
Checks to run during a trial
- Bind two frameworks to one program and confirm a single control can map to requirements in both.
- Record a failing test and confirm the control status changes.
- Let a piece of evidence expire and confirm it shows as stale in coverage and gap views.
- Invite an auditor with package-only access and confirm they can open only the overview and the evidence package.
- Open a remediation ticket from a finding and confirm its status syncs back.
- Publish one trust center document and confirm nothing else appears publicly.