In brief
A compliance platform organizes controls, owners, tasks and evidence; your team still decides and an independent auditor still assesses. Know the split.
What does a compliance platform do? It keeps requirements, controls, owners, tasks, documents and evidence in one system, sends reminders on a schedule and collects part of the evidence from source systems. It does not issue an ISO certificate, produce a SOC 2 report or operate controls for you: an accredited certification body issues the certificate and an independent CPA firm issues the SOC 2 report.
Who does what in a compliance program?
A compliance program has four roles, and the platform is only one of them. The internal team owns scope, operates controls and accepts risk. The platform keeps work, responsibility and evidence in one place where people can inspect it. Implementation specialists help interpret requirements and design controls. The auditor or certification body assesses independently and issues the result it is authorized to issue.
| Role | Primary responsibility | Should not |
|---|---|---|
| Internal team | Define scope, operate controls, approve policies, accept risk | Hand every decision to a tool or a vendor |
| Compliance platform | Organize workflows, evidence, control mapping, reminders, status and history | Declare a control "passed" on behalf of the accountable person |
| Implementation specialist | Interpret requirements, design controls, review gaps, resolve judgment calls | Advise and certify the same client |
| Auditor or certification body | Assess independently, issue the report or certificate | Build the management system it will later certify |
What manual work can a platform replace?
A platform replaces repeated coordination: the master tracking spreadsheet, email reminders, disconnected evidence folders and uploading the same file in several places. When controls are shared across frameworks, one evidence item can support several requirements instead of being copied. This is where most GRC time goes, as described in where spreadsheet compliance tracking breaks.
Integrations collect account, configuration, change or scan data on a schedule and keep the source and collection time. Workflows start review cycles, assign approvers and preserve the audit trail. The automated evidence collection guide covers that part in detail. For the seven recurring workflows most worth moving first, see manual compliance workflows to automate.
What work stays with people?
A platform does not replace accountable decisions. The internal team confirms operating reality, defines scope, approves policies and accepts residual risk. Specialists remain useful when requirements are hard to interpret, a control has several design options, or the company enters a specialized legal area such as HIPAA or personal data.
A concrete example: the platform can detect that this quarter's access review is overdue and assign it to the owner. The reviewer still examines the user list and decides which access to remove. The platform records that decision as evidence; it does not make it.
Why must the auditor be independent of the implementer?
Independence is a condition of the assessment standards themselves. For ISO certification, ISO/IEC 17021-1:2015 clause 5.2.5 states that a certification body "shall not offer or provide management system consultancy", as quoted by European Accreditation. For SOC 2, CPA firms perform the examination under professional standards set by the AICPA.
For a buyer this means a tool or implementation provider cannot assess its own work and promise the certificate. A vendor that promises you will certainly pass deserves follow-up questions.
If people still decide, why use a platform?
Most of the lost time sits before the decision: finding data, identifying owners, chasing due dates, checking versions and reconstructing history when the auditor asks. The platform prepares that context so accountable people decide faster and leave a trail that can be checked. When staff change, the history stays in the system rather than in one person's inbox.
What should you test in a demo?
Ask the vendor to walk one real control end to end instead of showing an overview dashboard:
- Which requirements map to this control, and which other frameworks share it.
- Who owns it, how often its task repeats, and who is reminded when it is overdue.
- Where the evidence comes from (integration or upload) and whether collection time is recorded.
- Who approves the evidence and where the approval history is kept.
- How an exception (a temporary, approved deviation) is recorded, approved and expired.
- How the auditor views evidence, and whether evidence can change after the audit is locked.
Ask which steps are automatic, which inputs your team must provide, and who is responsible for the conclusion.
Which part does pTrackly handle?
pTrackly combines a platform with managed compliance implementation support. In the platform, each evidence task has an owner, a frequency and a review date; the assignee submits it for review and the approver accepts it or requests changes, and every status change is logged. Controls are shared across frameworks, so a published policy or a finished task counts toward every framework it supports. Auditors work in a separate auditor portal, and when an audit is locked pTrackly keeps a frozen copy of the evidence with SHA-256 fingerprints. The responsibilities and deliverables page sets out the boundary between pTrackly and your team. Certificates and audit reports remain the work of authorized independent organizations. If you are still deciding whether you need a platform at all, read when a company needs a compliance platform.
Frequently asked questions
Does a compliance platform issue ISO 27001 certification?
No. An accredited certification body issues ISO 27001 certification after an independent audit. The platform prepares the controls, documents and evidence that audit examines.
Do you still need consultants if you use a compliance platform?
Usually, at the points that need judgment: interpreting requirements, designing controls and closing gaps. The platform removes repeated coordination, so specialist time goes to those decisions rather than to chasing evidence.
Why can't the certification body also advise you?
ISO/IEC 17021-1 clause 5.2.5 prohibits certification bodies from providing management system consultancy, to protect impartiality. The implementer and the certifier must therefore be different organizations.
Can a platform decide that a control passes?
A platform can run automated checks on some technical conditions and flag evidence that is due for renewal. Whether the evidence is sufficient for a specific assessment is decided by the accountable owner and the auditor.
