Engagements
An Engagement is one assessment cycle for a client — a specific scope of pillars and standards, assessed by a specific team, over a specific period. A client can have multiple engagements over time (e.g. an annual re-assessment), each producing its own scores, gaps, roadmap, and reports.
Only a Firm Administrator can create an engagement, from a client’s page (/clients/:clientId/engagements/new).
Creating an engagement
| Field | Notes |
|---|---|
| Name | e.g. “2026 Annual IAM Assessment”. |
| Start date | Required. |
| Target completion date | Optional. |
| Pillars | One or more of the four IAM pillars — defines which controls are in scope. |
| Standard versions | One or more, and each must currently be Active — inactive/superseded versions can’t be selected for a new engagement. |
Status lifecycle
Engagements move strictly forward through four statuses — see Roles & Workflow for the full table. A few rules worth calling out explicitly:
- Scope is locked once you leave Draft. Pillars and standard versions can only be edited while the engagement is still
draft. - Entering In Progress requires a team. You can’t move an engagement out of
draftuntil at least one active assessor is assigned. - Ratings can only be recorded while In Progress.
- Finalizing takes a permanent snapshot. The moment an engagement is finalized, its scores and gap analysis are frozen into an immutable snapshot — this is what powers Maturity Trend and ensures a finalized report always matches what was true at sign-off, even if scoring configuration changes later.
- The Roadmap stays editable through Finalized, and only locks once the engagement is
archived— everything else locks at Finalized.
All status and scope changes use optimistic locking: the app tracks a version number under the hood, so if someone else changed the engagement first, you’ll be asked to refresh before retrying.
Team
From an engagement’s Team tab, assign users to one of three roles — see Roles & Workflow for what each can do:
Assessor Reviewer Client Viewer
Removing someone from the team is non-destructive — it marks their assignment as removed rather than deleting it, so past activity stays attributed and they can be re-added later.
Next step
With a team in place and the engagement in_progress, start collecting Evidence and recording Ratings.