Steps: Aria drafts, a person approves, then it counts

A step opens from its row on the programme page's Steps tab, from the next step on a programme card or the Overview's Programmes panel, from its row in Documents, or from My work when it is assigned to you. A GDPR organisation duty also opens from Obligations, where its record details lead on to the same page. Wherever you start, the step is a full page of its own, so a link to it can be shared.

The step

The main column is what to do: where the step sits in its phase, what it requires, Aria's proposal when there is one, and the key questions — which are the form. The rail is who and what: a Workflow card with status · owner · reviewer · approver · due date (each saves as you change it), What this step produces, what it also closes in other frameworks, and, folded under More about this step, the Related links — shown, never counted.

Most questions are free text; a yes/no-shaped question renders as a Yes / Partly / No choice.

The five status words

You can set To do, In progress, In review and Not applicable yourself. Done is reached only through approval or through credit the plan finds; neither can be typed in. A Done step is read-only until someone whose role holds Approve evidence, programme steps and risk-plan sign-off reopens it.

Aria drafts

Two ways to ask. Ask Aria on a single question returns a suggestion you read before applying — nothing is stored until you accept it. Draft answers on the whole step reads your register — the systems, the risks, the suppliers, the records you already hold — and drafts every empty question at once. That draft is a proposal: it lands in Aria's Inbox with a note of what was read, and applying it fills empty fields only. What you wrote by hand is never overwritten.

Aria drafts and proposes; it never files. A draft counts for nothing until a person approves the step.

Approve and file

Approval belongs to the step's assigned approver, and to nobody else — there is no admin bypass. The approver's role must also hold Approve evidence, programme steps and risk-plan sign-off. The Org admin decides which roles hold it, in the role editor under Organisation → Members & roles; by default the Org admin, Compliance manager, Compliance officer and System owner roles do. Anyone else who needs to approve is assigned first, by someone whose role holds Assign programme step owners, reviewers and approvers, which leaves a trail. Every required question must be answered before the record can be filed. Approval is one transaction:

1. The record is filed as approved.
2. One evidence item is created and linked to everything the step closes — in this programme and, for a shared record, in its sibling programme too.
3. On an ISO programme, the Annex A rows the step implements are credited in the Statement of Applicability.
4. The step becomes Done, and the sibling programme is re-planned so a shared step there reads Done · credited.

Approving the internal-audit or management-review step also schedules the next one, a year on, on Assessments.

For the Statement of Applicability steps there is one more check: an exclusion without a justification sentence is refused (see The Statement of Applicability, generated from what you did).

Why approval is the only door

Because an unapproved machine record is worthless to an auditor, and because oversight by a natural person is the point. There is no auto-approve for a programme step, on any autonomy setting.

Guidance you can trust

Every step's guidance was generated from the owner's verified framework matrix and carries the reviewer's name and date. The GDPR's organisation duties are drawn from the same matrix and reviewed the same way, because they are binding law.