Skip to content
Open Coworking Stack

Compliance review

Review a coworking operation against applicable obligations and internal controls using scoped evidence, accountable human judgment, and tracked remediation.

Primary roles: owner-operator, operations-manager, technical-operator, consultant-implementer

Stages

1. Scope obligations and owners

Accountable leaders identify applicable jurisdictions, contracts, policies, systems, locations, data, and qualified advisers for the review.

Manual tasks

  • Confirm scope and obligations with appropriately qualified people
  • Assign control, evidence, decision, and remediation owners

Automation opportunities

  • Maintain the review schedule and owner register
  • Flag controls lacking current evidence or an accountable owner

Suggested tools

Risks

  • A generic checklist can miss local legal, lease, safety, or contractual duties

2. Examine controls and evidence

Reviewers test selected controls, interview staff, inspect physical practice, and record evidence limits rather than relying only on system settings.

Manual tasks

  • Sample real access, consent, retention, safety, and change practices
  • Assess exceptions and determine whether specialist advice is needed

Automation opportunities

  • Assemble approved evidence and access-review extracts
  • Highlight stale records or configuration differences for investigation

Suggested tools

Risks

  • Configuration evidence can differ from daily staff and member behavior
  • Review files can concentrate sensitive operational and personal data

3. Remediate and sign off

Control owners correct findings, reviewers retest material changes, and accountable leadership accepts or escalates residual risk.

Manual tasks

  • Prioritize findings by actual risk and approve remediation plans
  • Retest material controls and document residual-risk decisions

Automation opportunities

  • Track owners, due dates, dependencies, and review evidence
  • Remind accountable people about overdue remediation

Suggested tools

Risks

  • Closing tasks without retesting can create false assurance

Success metrics

  • Percentage of in-scope controls with a named owner and current evidence
  • High-risk findings open beyond the approved remediation date
  • Percentage of material remediations independently retested

Last reviewed: 2026-07-18