Audit & Compliance Manual

Scheduled Reports

Recurring reporting cadence, audience targeting, and the operational discipline around scheduled compliance output.

Audience: Compliance owners and stakeholdersFocus: Reporting cadence and recurring communicationStatus: Public manual

Scope

Scheduled reporting matters when posture needs to stay visible without forcing operators to rebuild the same package every week. The public guide keeps the cadence model and leaves private export mechanics out.

SSOT Document — Single Source of Truth Audience: System operators, IT administrators, L1/L2 support staff Last Updated: 2026-04-15

Overview

Scheduled Reports lets you set up automatic PDF report delivery via email on a recurring schedule. You define the report type, target program, cron schedule, recipient list, and format. Meridian generates the report and emails it to the recipients on schedule.

Getting Started

Prerequisites

Meridian.manage permission to create, edit, or delete reports.
Meridian.view permission to view the report list.
The scheduled_reports feature must be enabled on your license plan.
At least one compliance program must exist to scope program-specific reports.

Managing Scheduled Reports

Creating a Scheduled Report

Steps: 1. Navigate to Settings > Scheduled Reports. 2. Click New Schedule. 3. In the modal, fill in: - Report Type: Select from Compliance Readiness, Executive Summary, Risk Report, or Audit Report. - Program: Select the target compliance program (not required for Audit Report). - Schedule: Choose a preset (Weekly Monday 9am, Monthly 1st 9am, Quarterly) or switch to Custom for a raw cron expression. - Recipients: Enter email addresses, separated by commas or newlines (max 50). - Format: PDF (currently the only option). 4. Click Create.

Result: The report appears in the list with status Active. It will be generated and emailed on the defined schedule.

Pausing a Scheduled Report

When to use: You want to temporarily stop delivery without deleting the schedule.

Steps: 1. In the report list, find the report row. 2. Click the Pause button (pause icon).

Result: Status changes to Paused. No reports are delivered until you resume.

Resuming a Paused Report

Steps: 1. Find the paused report in the list. 2. Click the Resume button (play icon).

Result: Status returns to Active. Delivery resumes on the next cron trigger.

Deleting a Scheduled Report

Steps: 1. Find the report in the list. 2. Click the Delete button (trash icon). 3. Confirm the deletion in the dialog.

Result: The scheduled report is permanently deleted.

Report Types

Report Type	Description
Compliance Readiness	Program-scoped compliance posture summary
Executive Summary	High-level program status for leadership
Risk Report	Risk register summary with scores and treatment status
Audit Report	Cross-program audit readiness report
MSP Client Report	Multi-tenant client status (requires MSP addon)

Schedule Reference

Schedules use 5-field cron syntax (UTC):

Presets available in the UI:

Preset	Cron Expression
Weekly (Monday 9am)	`0 9 * * 1`
Monthly (1st, 9am)	`0 9 1 * *`
Quarterly (Jan/Apr/Jul/Oct)	`0 9 1 1,4,7,10 *`

Switch to Custom to enter any valid 5-field cron expression.

Report List Columns

The table displays:

Column	Description
Report	Report type and format
Program	Scoped program name (or – for audit reports)
Schedule	Cron expression
Recipients	Email count or single address
Last Sent	Timestamp of the most recent successful delivery
Status	Active (green), Paused (yellow), or Disabled (red)

Status Meanings

Status	Meaning	Action Required
Active	Report is scheduled and will deliver on the next cron trigger.	None.
Paused	Delivery is suspended. No reports are generated or sent.	Resume when ready.
Disabled	Delivery failed 3 consecutive times. The system stopped trying.	Investigate `last_error`, fix the issue, then re-activate via PATCH status=active.

Permissions Reference

Permission	Grants
`Meridian.view`	View the scheduled reports list
`Meridian.manage`	Create, pause, resume, delete scheduled reports

Delivery Behavior

The delivery job runs every 60 seconds. When a report’s cron schedule fires:

Meridian generates the PDF report using current program data.
The PDF is delivered to all configured recipients.
Last Sent is updated to the delivery time.

Failure Handling

If delivery fails (e.g., the target program was deleted, PDF generation error):

The error is recorded in last_error.
consecutive_failures increments.
After 3 consecutive failures, the report transitions to Disabled.
A successful delivery resets the failure counter to 0.

If the PDF/email send succeeds but Meridian later hits a bookkeeping or audit-log error, the report still counts as delivered. Last Sent is still advanced so the same cron window is not re-sent, and the failure counter does not increment. Treat that case as an operator follow-up on telemetry, not as a delivery retry signal.

Cron Expression Validation

Invalid cron expressions are rejected at create/update time with a 422 error. Only valid 5-field cron expressions (minute hour day-of-month month day-of-week) are accepted.

Email Validation

Recipient email addresses are validated at create/update time. Malformed addresses, injection payloads, and non-email strings are rejected with a 422 error.