Compliance 360 Audit Approval Workflow: Setup to Completion

The Compliance 360 audit approval workflow in NetSuite 2026.2 lets teams require approval before a Compliance Officer completes an audit. Compliance 360 SuiteApp version 3.1.0 introduces this optional workflow, but installation or upgrade does not enable it. Adoption requires a separate setting, prepared control outcomes, an audit summary, and an assigned reviewer with appropriate permissions.

Key takeaways

A Compliance Officer enables approvals at Compliance 360 > Settings > View, under Audit Workflow Settings, using Enable Audit Workflow.
Approval is disabled by default. The setting applies to future audits; changing it does not change completed audits.
Submission requires every control to have a Pass or Fail outcome and Audit Insights to contain the audit summary. Supporting evidence alone is insufficient.
The Compliance Audit Approver reviews assigned audits without editing their content.
Approval and completion are separate actions. Reopened audits must follow approval again before completion.

Before you enable approvals

Establish who will prepare audits, who will review them, and who will perform completion. An administrator must assign a SuiteApp-provided role to each participating user and set that role’s permissions. Treat role configuration and workflow activation as separate rollout checks: enabling approvals does not establish that your intended reviewer has suitable access.

Use Compliance 360 SuiteApp version 3.1.0 as the basis for this NetSuite 2026.2 procedure. Arrange access for a Compliance Officer to manage the setting and audit lifecycle, and for a Compliance Audit Approver to review assigned audits.

Prepare a test scenario covering acceptance, rejection, and reopening. A Release Preview test plan for business workflows can help organize participants and expected outcomes. Oracle’s Audit Approval Workflow reference provides the supporting workflow documentation.

1. Enable the Compliance 360 audit approval workflow

Using the Compliance Officer role:

Go to Compliance 360 > Settings > View.
Open the Audit Workflow Settings subtab.
Check Enable Audit Workflow to enable approvals for future audits.

When enabled, the workflow requires approval before a Compliance Officer can complete an audit. When disabled, future audits follow the simplified In Progress to Completed path without a separate approver decision.

Keep configuration scope separate from audit status. The setting applies to future audits, and changing it does not change completed audits. Do not plan to disable the setting as a workaround for an existing audit’s approval requirements.

For rollout testing, record the setting used for each test audit rather than assuming all audits follow the same route. Include this configuration check in your business workflow testing in Release Preview, alongside submission and completion checks.

2. Prepare control outcomes and Audit Insights

The submission requirements are specific: every audit control must have a Pass or Fail status, and Audit Insights must contain the audit summary. Once both requirements are satisfied, the audit becomes Ready for Submission.

Submission requirement	What to check before handoff
Every audit control has a Pass or Fail status	Review every control for an outcome, not just those with attached evidence.
Audit Insights contains the audit summary	Confirm that the summary is present as well as the individual control results.

Supporting evidence is review material, not a replacement for either submission requirement. A Fail outcome is allowed for submission: every control needs an outcome, but every control does not need to pass. Use the summary to give the reviewer context for the recorded results, including failed controls.

Supporters can contribute evidence and mark assigned controls Pass or Fail, but saving their work does not submit the audit. The Compliance Officer checks readiness and submits it to the assigned approver.

If preparation involves reassignment, users with permission to edit audit controls can select controls and use Bulk Assignment to apply the same assignee or due date. All selected controls must belong to the same audit. Supporters cannot change Assigned To in the Audit Control section, so assignment planning must respect that role boundary.

3. Configure roles and verify the assigned reviewer

To begin permission configuration, go to Setup > Users/Roles > Manage Roles and click Customize beside a SuiteApp-provided role. Confirm that the users responsible for preparation, review, and completion have the appropriate role assignments and permissions.

Role	Responsibilities	Boundaries to verify
Compliance Officer	Accesses all SuiteApp controls and pages, including audits, audit templates, dashboard, activity logs, and settings; manages audits, assignments, submission, resubmission, completion, reopening, and workflow settings.	Requires approval before completion when the workflow is enabled.
Compliance Audit Approver	Reviews assigned audit information, controls, insights, and attachments; can print, approve, or reject assigned audits in Pending Approval or Resubmitted status.	Review is read-only; the approver cannot edit audit content.
Compliance Audit Supporter	Accesses audits and audit templates, contributes evidence, marks assigned controls Pass or Fail, and saves supported work.	Cannot submit, edit primary information, change Assigned To in the Audit Control section, or access the dashboard and activity logs.

Users can hold multiple roles. The highest level applies in this order: Compliance Officer, Compliance Audit Approver, then Compliance Audit Supporter. Test with the actual reviewer’s role combination, not only an officer’s broader access.

A Compliance Officer who also holds the Compliance Audit Approver role can select themselves as approver. If your policy requires independent review, check both role assignments and the audit’s approver selection. Workflow activation alone does not establish that independence. The broader guide to creating approval rules in NetSuite provides related approval-planning context; this procedure uses Compliance 360’s own workflow setting.

Do not treat control assignment as a blanket security boundary. Supporters can create audit controls and delete controls even when those controls are not assigned to them.

4. Submit the audit and follow its review status

Once the audit is Ready for Submission, the Compliance Officer submits it for the assigned approver’s decision. The approver reviews the submitted material rather than correcting it in place. Finish preparation before handoff; the reviewer then decides whether to accept the material or reject it for revision.

Audit status	Meaning or supported next action
In Progress	Starting status for a new audit.
Ready for Submission	Controls and Audit Insights meet the submission requirements.
Pending Approval	Submitted for the assigned approver’s decision.
Approved	Accepted by the approver; the Compliance Officer can complete it.
Rejected	Can be revised and resubmitted for another decision.
Resubmitted	Revised audit is available for another approval decision.
Completed	A Compliance Officer can reopen the audit.
Reopened	Open for changes and must follow approval again before completion.

Audits in Pending Approval, Approved, Resubmitted, and Completed are locked against ordinary content changes. Plan corrections around rejection and resubmission or reopening, rather than expecting reviewers to edit the audit directly.

Version 3.1.0 also introduces automatic email notifications for supporters, approvers, and officers for their respective assignment and review events. Use the audit status to establish its current lifecycle position and Status Updates to examine recorded events.

Worked example: a failed control does not prevent submission

This illustrative process shows the required handoffs, not additional UI button labels or configuration fields.

Stage	Example action or result
Configuration	The Compliance Officer enables the workflow for future audits.
Preparation	Control A is Pass, Control B is Fail, and Audit Insights contains a summary explaining both outcomes.
Readiness	Both controls have an allowed outcome and the summary is present; the audit becomes Ready for Submission.
Submission	The Compliance Officer submits the audit to its assigned approver; status is Pending Approval.
Review	The Compliance Audit Approver reviews the material in read-only mode and approves it.
Completion	The Compliance Officer completes the approved audit.
Verification	The team reviews Status Updates for submission, the decision, and completion.

The failed control does not invalidate this example’s submission prerequisites. It also does not guarantee approval: the approver’s decision remains a separate step. This distinction is useful when testing whether the team understands readiness versus acceptance.

5. Revise rejected audits and plan reopening

A rejected audit can be revised and resubmitted for another decision. Have the preparation team address the reviewer’s concerns, then have the Compliance Officer resubmit it. In Resubmitted status, the assigned Compliance Audit Approver can approve or reject the audit without editing its content.

Keep the submission checks in the revision checklist: every control needs Pass or Fail, and Audit Insights needs the audit summary. Where comments are entered, use them to explain the decision and subsequent correction so another reviewer can understand the sequence.

Reopening serves a different point in the lifecycle. A Compliance Officer can reopen a Completed audit for changes, but the reopened audit must follow approval again before completion. Plan reviewer availability when reopening completed work; content revision and renewed approval both belong in that plan.

6. Complete the approved audit and verify workflow history

After approval, the Compliance Officer must complete the audit. Approved is not the same as Completed: the reviewer’s decision does not perform the officer’s final action. Include this last handoff in the rollout checklist.

Verify that the audit reached Completed after approval and the officer’s completion action. Then inspect the Status Updates subtab for workflow events and comments, including submission, approval decisions, completion, and reopening where applicable. For a rejection test, check the decision and subsequent resubmission rather than only the final status.

Compliance Officers can also review workflow-setting changes, including who made each change and any comments entered. Keep the records conceptually separate: audit events explain an individual audit’s progression, while setting changes explain configuration decisions. Reviewing both can help the team distinguish preparation problems, review handoff problems, and activation misunderstandings.

FAQ

Does installing Compliance 360 v3.1.0 automatically enable approvals?

No. Approval is disabled by default. A Compliance Officer must enable it separately using Enable Audit Workflow. The setting applies to future audits.

Does every audit control need to pass before submission?

No. Every control must have either Pass or Fail, and Audit Insights must contain the audit summary. Supporting evidence alone does not meet these requirements.

Can the Compliance Audit Approver edit an audit during review?

No. The approver reviews assigned information, controls, insights, and attachments in read-only mode and can approve or reject assigned audits in Pending Approval or Resubmitted status.

Does approval automatically complete an audit?

No. The Compliance Officer completes the audit after approval. If a completed audit is reopened, it must follow approval again before completion.