Templates & checklists

Free, editable starting points for your compliance program — policy templates, readiness checklists, and questionnaires. Each is a sample to adapt to your organization, not legal advice.

SOX control matrix (RCM) template

A free SOX control matrix (risk-and-control matrix) template with the columns auditors expect. Copy the structure and see what each field captures for ICFR documentation.

Vendor risk assessment template & checklist

A free vendor (third-party) risk assessment template: criticality tiering, the security and compliance questions to ask, and how to set review cadence by tier.

SOC 2 readiness checklist

A free SOC 2 readiness checklist organized by the Trust Services Criteria. Work through scoping, the common-criteria controls, and evidence before you engage an auditor.

AI governance policy template

A free AI governance and acceptable-use policy template. Copy the section outline covering approved tools, data handling, human oversight, and inventory — aligned to ISO 42001 and the NIST AI RMF.

User access review checklist

A free user access review (UAR) checklist: what to review, how to evidence each decision, and the pitfalls that make an access review fail an audit.