Appearance
SLA & Deadlines
Where to find it: Administration, then SLA & Deadlines (/settings/sla).
SLA policy governs how long work has before it is due, by routing tier.
What is configured
| Setting | Purpose |
|---|---|
| Tier SLA days | How many days work at each routing tier has |
| Default days | Used when a tier is missing or unrecognised |
| Due-soon threshold | How many days ahead something counts as approaching |
| Manual override allowed | Whether a due date can be set by hand |
Routing tiers
Tiers describe how much governance a piece of work requires, and consequently how long it is given.
| Tier | Typical use | Default |
|---|---|---|
tier_1 | Critical; the full approval chain | 30 days |
tier_2 | High; a single second-line review | 60 days |
tier_3 | Self-certification; low | 90 days |
The defaults above are the shipped values and are tenant-configurable.
Shorter for higher tiers is not a mistake
Tier 1 work has the shortest SLA and the longest approval chain. That is deliberate: critical obligations should move fastest and be scrutinised most.
A tier structure where critical work has the most time is a structure that will produce late critical work.
Tiers also influence workflow template selection: a binding can select a lighter chain for tier_3.
Derived deadlines versus captured deadlines
This distinction runs through the whole platform and is worth stating plainly.
| Derived | Captured | |
|---|---|---|
| Source | SLA policy, applied to work | Recorded from an external fact |
| Example | An obligation activity due in 30 days | A regulation's transitional compliance date |
| Changes when | Policy changes | The external fact changes |
| Permission | sla.configure | deadline.configure |
Both appear on the GRC Calendar.
A missing date is never derived into existence
Where a record has no deadline, OrviQ reports no deadline. It does not compute one from a frequency field or a criticality tier.
The clearest case is TPRM engagements: reassessment frequency is guidance, and a review date must be set deliberately. An engagement with no review date reports none — which correctly says nobody has scheduled a review, rather than showing a plausible-looking derived date nobody committed to.
Manual override
Where manual override is permitted, a due date can be set directly rather than derived from policy.
Enabling it trades consistency for flexibility. Where it is on, expect due dates to diverge from policy, and expect to explain the divergence during an audit of your deadline management.
Capturing regulatory deadlines
Requirement and framework compliance deadlines are captured deliberately, typically during Smart Extract review when a clause carries a date.
Requires deadline.configure, which is separate from both owner assignment and library editing — capturing a regulatory deadline is a compliance governance act, not a data entry one.
What SLA policy drives
| Consequence | Where |
|---|---|
| Due dates on obligation activities | Compliance Activities |
| Due-soon and overdue states | Workbench, registers |
| Calendar entries | GRC Calendar |
| Reminder and escalation behaviour | Notifications |
| Overdue signals on risks | Risk Register |
Setting policy sensibly
Match tiers to your approval chains. A tier whose SLA is shorter than its chain typically takes will produce permanently overdue work.
Set the due-soon threshold to the time it takes to act. Seven days is useful if a week is enough to complete the work. For a quarterly review requiring coordination, it is not.
Change policy deliberately. Shortening an SLA moves a cohort of work into overdue overnight. That may be the intent; it should not be a surprise.
Permissions
| Action | Permission |
|---|---|
| View tenant settings and policies | settings.read |
| Edit tenant SLA and deadline policy | sla.configure |
| Capture requirement and framework deadlines | deadline.configure |
| Edit tenant settings generally | settings.manage |
Example
A bank's SLA policy.
| Setting | Value | Reasoning |
|---|---|---|
tier_1 | 21 days | Critical obligations; four-stage chain typically completes in 12 to 15 days |
tier_2 | 45 days | High; single second-line review |
tier_3 | 90 days | Self-certification |
| Default | 45 days | Applied where tier is unset |
| Due-soon threshold | 10 days | Matches the time to coordinate evidence across departments |
| Manual override | Off | Consistency preferred; exceptions handled by re-tiering |
The tier 1 figure was tuned. It started at 30 days. Analysis showed the four-stage chain typically completed in 12 to 15 days, and that work assigned 30 days was routinely started at day 20. Shortening to 21 days moved the start earlier without increasing overdue rates.
Manual override stayed off after a review found that the previous system's manual due dates diverged from policy on roughly a third of items, with no recorded reason.
Troubleshooting
"Work is overdue immediately after a policy change." Shortening an SLA reclassifies existing work. Expected.
"An obligation has no due date." No deadline was captured and no tier applies. OrviQ does not derive one.
"Due-soon items are not appearing." Check the threshold, and confirm the work has a due date at all.
"I cannot edit SLA policy." Requires sla.configure, which is separate from general settings management.