> For the complete documentation index, see [llms.txt](https://docs.ruler.nl/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ruler.nl/getting-started/compliance-cycle.md).

# The compliance cycle in Ruler

How the parts of Ruler fit together, from an incoming alert to a completed monitoring report.

The menu in Ruler is not arbitrary. It follows the steps a compliance function goes through when regulation changes, and each part of Ruler hands over to the next.

```mermaid
flowchart LR
    A[Inbox] --> B[Legal Framework]
    B --> C[Control measures]
    C --> D[Risks]
    D --> E[Tasks]
    E --> F[Monitoring]
    F --> G[Control]
    G -.-> A
```

**Inbox.** Ruler's editors send you an alert when something relevant changes: a new guideline, an amended article, a consultation, a radar item that moves to the next stage. You score the alert on impact and, if it matters, create a task to follow it up.

**Legal Framework.** The alert points to the theme and topic it affects. Each topic summarises the relevant regulation and lists the articles and documents behind it. You assess, per topic, whether your organisation complies in **design** (you have a policy or procedure) and in **effectiveness** (that policy works in practice). The Radar shows what is coming, so you can prepare before a rule enters into force.

**Control measures.** To show how you comply with a topic, you link one or more control measures: your policies, procedures and controls. The library keeps them in one place with their documents and revision dates.

**Risks.** Where a high-level design and effectiveness assessment is not enough, you carry out a risk assessment: identify the risk, link it to the standard and to the control measures that mitigate it, and score gross and net risk.

**Tasks.** Anything that needs doing, from an impact analysis after an alert to updating a procedure after a risk assessment, becomes a task with an owner and a deadline. Tasks can be created from almost every page.

**Monitoring.** Tasks marked for the monitoring agenda form your monitoring plan. Monitoring reports record what you found and link the results back to control measures and topics. This closes the cycle: you can demonstrate that the measures you rely on actually work.

**Control** (optional). Administrators check that tasks were completed and that their completion had the intended result, and create control tasks where it did not.

{% hint style="success" %}
**Ruler in practice**

The cycle only closes if each step hands over to the next. Ruler recommends creating a task for every alert, radar item or risk that is relevant to your organisation, so the follow-up is visible and assigned rather than left to memory.
{% endhint %}