People and Policy Acknowledgements

Overview

Auditors for SOC 2 and ISO 27001 want proof that your staff read and accepted your current policies, completed security training, were screened when they joined, and lost access when they left. People keeps that record in one place, in Data Hub → People, and turns it into control evidence automatically.

People has five tabs: Personnel, Policies, Training, Background Checks, and Groups.

Who Can Use People

People is part of Concord Trust Premium and Enterprise. Owners and Admins manage it. Everyone listed completes their own policies on Your Policies and their training on Your Training, whether or not they have a Concord account (see How People Acknowledge).

Adding People

1. Go to Data Hub → People → Personnel.
2. Add a person, or choose Import CSV from the menu to add many at once.
3. For each person, set whether they're an employee or a contractor, and add a start date if you have one.

Adding a person never sends them an email. Emails go out only when you send them yourself or when the weekly reminder runs.

Groups

Groups decide who owes which policy or training.

• All Personnel is built in and always includes everyone.
• Create other groups on the Groups tab, such as Engineering or Customer Support, and add people from the group or from the person's form.
• A group that is the only one assigned to a policy can't be deleted.

Someone who joins a group, or whose group is assigned a policy later, owes it from that date and gets the full time to complete it.

Requiring Policies

1. Open the Policies tab and add a required policy.
2. Choose a published policy. Policies written in Concord and uploaded PDF or DOCX policies both work.
3. Choose the groups who must acknowledge it. All Personnel is the default.

Each policy shows how many people have acknowledged it and who is overdue. Someone is overdue once Days to Acknowledge has passed (30 days by default, see Settings).

Asking Everyone Again

When a policy changes, you can start a new round so everyone acknowledges the new version:

• Choose Ask Everyone Again on People, or
• Tick the option in the Publish dialog when you publish the new version.

Requiring Training

Training works the same way as policies. Create the training in Documents → Training, optionally with a short quiz (see Training and Quizzes), then require it on the Training tab and assign it to groups.

• People complete in-app training on Your Training. When the training has a quiz, the score that passed it is recorded.
• For training done on another platform, choose Record Completion, pick who completed it and when, and add an Evidence Link to the provider's completion record. Upload a certificate only when there's no link.
• A completion counts for one year. Training completed more than a year ago can't be recorded for the current round.

How People Acknowledge

Everyone acknowledges policies on Your Policies and completes training on Your Training. Each page is one table of everything they owe, are overdue on, or have completed.

• People with a Concord account open these pages from the email, or from their task in My Work.
• People without a Concord account are invited as guests. The button in their email signs them in with a one-time passcode sent to their address. They see only their own policies and training, and offboarding them ends that access.

Opening an owed policy shows it in full with a statement to tick. Opening one they already acknowledged shows the exact version they agreed to.

Each acknowledgement is recorded permanently and pinned to the version they saw: the version and its content fingerprint, the policy name, their name and email at the time, the time, and their IP address and browser. Acknowledgement records can't be edited or deleted.

Reminders

• Email Outstanding emails everyone who still owes something.
• Send Link on a person's row emails just that person.
• A weekly reminder goes out automatically to everyone with something outstanding, plus one more a set number of days before it's due (Reminder Days Before Due in Settings).

Offboarding

When someone leaves, offboard them instead of deleting them. People with acknowledgements can be offboarded but never deleted, so the audit history stays intact.

When you offboard someone, record when their system access was removed, with an optional link to the ticket, or mark it Not Required and say why. Days to Remove Access (1 day by default) sets how quickly access must be removed after their end date.

Background Checks

The Background Checks tab records that each person was screened, without storing the screening report itself.

1. Choose Record Background Checks and pick the people.
2. Choose the outcome: Completed, with the date and an evidence link to the result in your screening provider, or Not Required, with the reason (for example, the role has no access to customer data, or local law doesn't allow it).
3. Upload a file only when there's no link, and only a one-page summary or certificate, never the full report.

Background check records can't be changed. To correct one, record a new one; auditors rely on earlier records staying as they were.

Evidence for Audits

People feeds your controls automatically:

• Policy acknowledgement and Code of Conduct acknowledgement controls pass when everyone in scope has acknowledged the current version.
• Offboarding controls pass when access was removed in time.
• Background check controls pass when everyone has a completed or not-required check.

From the menu, you can also export:

• Export Personnel: everyone who was active during an audit window you choose.
• Export Acknowledgement Log: every acknowledgement, with the version and time.

Settings

Choose Settings from the People menu: