Skip to main content

Work queue, reviews and SLAs

Three pages turn what is happening inside your clients into work your staff can pick up: the work queue collects the open items, SLA policies give each a deadline, and reviews put the recurring client meetings on a schedule with their preparation done in advance.

Work queue​

Nobody creates a work item by hand. The queue is built from your clients' own records. SolveGRC rebuilds it every hour, and Refresh rebuilds it now (once every 30 seconds). An item appears whenever a client holds one of:

  • a finding open, in remediation or reopened (finding remediation);
  • an evidence request pending or in progress (evidence request); once evidence is submitted, it moves to Evidence Triage;
  • a requirement exception submitted and not yet reviewed (exception review);
  • a control attestation not yet fulfilled (attestation pending);
  • a drift event nobody has acknowledged (drift acknowledge);
  • onboarding stalled below 60% readiness for more than a week (onboarding blocker).

Each item carries the client, an assignee and an SLA deadline, and sits in one of three urgency bands: overdue, at risk (due within 24 hours) or on track. Some items also carry a severity. Evidence, exception and attestation items carry none. The five counters at the top give total, overdue, at risk, unassigned and yours.

Filter by kind (eight chips, each with a count; Report Pending and Renewal Due never have items), urgency, assignment (all, mine, unassigned), client and sort order, or search titles. The Assigned to me filter currently returns every assigned item, not only yours. Assign an item from its row; select several and Reassign to a member to move them together. Selection covers only the current page of 50 items. Apply with no member picked unassigns the selected items. Auditors can see the queue but not assign. An item leaves the queue when its source record closes in the client.

SLA policies​

SLA Policies (Settings, administrators) sets how long each kind of work item gets before it is overdue. Without a policy, built-in defaults apply (for example two weeks for a finding, a week for an evidence request, three days to acknowledge drift, a day for a failing connector).

A policy is one row per work item kind, either MSP-wide or for one service package; a package policy overrides the MSP-wide one for that package's clients. It sets the base duration (presets from 24 hours to 30 days, or any number of hours up to a year) and optional per-severity overrides, so a critical finding can get 24 hours while the rest keep the base. Where a client record already carries its own due date, that date wins. Evidence requests dispatched from a batch use their due date as the deadline, so SLA policies do not change them. Changes show up in the queue on its next rebuild.

Missing an SLA deadline only moves the item into the Overdue band and counter. No notification appears in the app, and nothing escalates.

Reviews​

A review cadence is a recurring client meeting: monthly, quarterly, semi-annual or annual, of a type (check-in, QBR, program review, custom), anchored to a date, with a preparation window (14 days by default) and an overdue threshold (7 days). A schedule's next occurrence is created when someone clicks Complete Review on the current one, or automatically each night once its date falls inside the prep window. Cadence schedules are set up through the API today; Manage Schedules shows them read-only, with cadence, type, anchor, prep window, overdue threshold, whether a packet is generated automatically (the setting is stored, but nothing uses it), and status.

Reviews lists the next 90 days in three groups: overdue, prep ready (inside the prep window) and upcoming, each with client, cadence, type, date, state and reviewer. Open one to prepare it.

Preparing a review​

The preparation page shows the occurrence (scheduled and due dates, state, whether a report has been generated) and a prep snapshot of the client over the review period, in five tabs: compliance (each framework's coverage at the start and end of the period, with the delta), findings (Total, Critical, High and Overdue for the client's current open findings, not the review period, and the top ten), drift (unacknowledged, acknowledged, resolved), evidence (stale items) and renewals (due in the next 90 days). The snapshot is calculated each time the page loads.

  • Start Prep takes the preparation lock. Only the lock holder can edit the prep notes, which save themselves two seconds after you stop typing. Anyone else sees a Locked badge, which does not name who holds the lock. Start Prep is hidden while a lock exists.
  • Generate QBR produces the packet for the review.
  • Complete Review closes the occurrence with optional notes and schedules the next one.
  • Snooze (administrators) moves the occurrence to a new date with a reason. A snoozed review then disappears from every list, and nothing brings it back, even after the new date.

The dashboard's Upcoming Reviews card shows the next 30 days with the overdue and prep-ready counts.