Compliance 360 3.1.0 Audit Workflow and Approvals

Compliance 360 SuiteApp version 3.1.0 separates audit preparation from approval, adds bulk control assignment, and notifies users about required actions. The approval workflow is disabled by default. Compliance Officers must enable it for future audits to require an approval decision before completion; recording control results alone does not satisfy that requirement.

What’s New in Compliance 360 3.1.0?

The release adds five capabilities: an Audit Approval Workflow, a dedicated Compliance Audit Approver role, a Status Updates subtab with workflow history, bulk assignment of audit controls, and automatic email notifications.

The central distinction is between finishing audit work and authorizing audit completion. With the workflow enabled, recording control results is not enough to complete an audit: the assigned approver must first approve it. With the workflow disabled, future audits use a simplified path without a separate approval decision.

For broader release reading, see the NetSuite 2026.2 release notes additions and updates. The documented SuiteApp version for the changes covered here is 3.1.0.

How Do You Enable the Audit Approval Workflow?

A user with the Compliance Officer role can enable or disable the workflow for future audits. It is not enabled automatically on installation or upgrade.

To enable it:

1. Go to Compliance 360 > Settings > View.
2. Open the Audit Workflow Settings subtab.
3. Check Enable Audit Workflow.

When disabled, future audits move from In Progress to Completed without a separate approver decision. Changing the workflow setting does not change completed audits. Before changing the setting during active audit work, verify how you will handle unfinished audits rather than assuming the change applies retroactively.

Rollout recommendation: Decide which future audits should require approval before enabling the setting. Record that decision alongside your operating procedure, and check the workflow-setting history afterward to confirm who made the change and any comments entered.

What Does Submission Require, and Which Statuses Follow?

Every audit control must have a Pass or Fail status, and Audit Insights must contain the audit summary before submission. These are completeness requirements: the documented submission condition is that every control has a result, not that every control passes.

The lifecycle includes eight statuses:

An approval does not itself complete the audit. The Compliance Officer completes it after approval. Likewise, reopening does not bypass review: a reopened audit must follow another approval cycle before it can be completed again.

Which statuses restrict editing?

Audits in Pending Approval, Approved, Resubmitted, and Completed status are locked against ordinary content changes. Approvers review rather than edit audit content. Teams should therefore plan corrections around the review cycle rather than expect to revise controls directly while an audit awaits a decision.

Verification recommendation: Test a rejection-and-resubmission cycle as well as a straightforward approval. Also test reopening a completed audit, because that path requires another approval rather than simply returning the audit to completion.

How Do Compliance Roles Divide the Work?

An administrator must assign a SuiteApp-provided role to each user and configure its permissions. Users can have multiple roles; when they do, the highest level applies in this order: Compliance Officer, Compliance Audit Approver, Compliance Audit Supporter.

Supporter access has important boundaries. Supporters can access audits and audit templates, but not the dashboard or activity logs. They cannot edit an audit’s primary information or change the Assigned To column in the Audit Control section. However, they can create and delete audit controls even when those controls are not assigned to them. Do not treat assignment as the boundary for every control-related action.

To begin configuring role permissions, go to Setup > Users/Roles > Manage Roles, then click Customize beside a SuiteApp-provided role.

Separation-of-duties caution: A Compliance Officer who also has the Compliance Audit Approver role can select themselves as approver. If your organization requires independent review, treat role combinations and approver selection as explicit governance checks rather than assuming the workflow prevents self-approval.

Where Can You Review Audit Workflow History?

The new Status Updates subtab displays workflow events and comments, including submission, approval decisions, completion, and reopening. Compliance Officers can also review workflow-setting changes, including the user responsible for each change and any comments entered.

Use audit status history to understand an individual audit’s review sequence, and setting-change history to understand changes to the approval requirement. During rollout, verify that reviewers and officers know where to inspect the relevant history instead of relying only on email.

For additional reading, see the NetSuite help updates covering audits, AI, and banking.

How Does Bulk Assignment of Audit Controls Work?

Select multiple audit controls, then use Bulk Assignment to apply the same assignee or due date to the selected controls. This avoids repeating the same update individually when a group of controls needs a common owner or deadline.

Three conditions apply:

• The user must have permission to edit audit controls.
• Every selected control must belong to the same audit.
• The audit must be editable.

Bulk assignment therefore is not a cross-audit reassignment tool, and it does not override audit editability restrictions. Before a large update, verify the selected controls, intended assignee, and due date. Afterward, check the resulting assignments and dates, particularly where only part of an audit should change.

Which Automatic Email Notifications Are Sent?

Compliance 360 sends automatic emails for control assignments and approval-related actions. These messages are separate from configurable key performance indicator notifications and activity-log backup notifications.

When several controls are assigned to the same user in one action, Compliance 360 combines their details into one notification. A bulk-assignment test should therefore check both the resulting controls and the consolidated email, rather than expecting a separate message for every control.

Who This Affects

• Administrators: Assign SuiteApp roles, review permission configuration, and assess users with multiple roles.
• Compliance Officers: Enable the workflow, prepare submissions, respond to decisions, complete approved audits, and reopen audits when necessary.
• Compliance Audit Approvers: Review assigned audits without editing their content and issue approval or rejection decisions.
• Compliance Audit Supporters: Contribute control work and supporting evidence, receive assignment emails, and save work without submitting audits.

Acceptance testing should cover all three compliance roles, not just the officer who enables the setting. In particular, check the handoff from supporter preparation to officer submission, then from approver decision back to officer follow-up.

Key Takeaways

• Compliance 360 version 3.1.0 adds an optional approval workflow; installation or upgrade does not enable it automatically.
• Submission requires a Pass or Fail result for every control and an audit summary in Audit Insights.
• Approval and completion are separate actions, and reopened audits require another approval cycle.
• Bulk assignment requires edit permission and controls within one editable audit; multiple control assignments to one user in one action produce one notification.
• Review role combinations carefully: an officer with the approver role can select themselves as approver.