figma guide
Designing compliance audit evidence and certification renewal UI in Figma: controls, requests, and renewal timelines
Design compliance audit evidence and certification renewal UI in Figma with control libraries, evidence requests, auditor portals, renewal countdowns, and gap remediation workflows.
- Published
- Updated
- Jul 30, 2026
- Read time
- 11 min
- Level
- Intermediate
Quick answer
Compliance audit evidence and certification renewal UI is how GRC teams prove controls work—collect screenshots, logs, and policies on schedule, respond to auditor requests, and track renewal deadlines before badges expire on the trust center. Design a control library mapped to SOC 2 / ISO frameworks; an evidence collection workspace with recurring tasks and auto-ingested artifacts; an auditor portal with read-only access and request threads; and a renewal timeline with gap remediation linked to security posture dashboard. Start from the Figma guides hub and pair with trust center, compliance exports, vendor risk, audit log, and Dev Mode handoff.
Who this is for
- Product designers building GRC platforms, audit prep tools, or internal compliance modules for B2B SaaS.
- Design system teams aligning control status chips, evidence cards, and renewal countdowns with badges, tables, and progress indicators.
- GRC, security, and legal teams running SOC 2 Type II, ISO 27001 surveillance audits, and certification renewals.
Compliance hub (internal overview)
ComplianceHub — Audit period: Oct 2025 – Sep 2026 · Framework: SOC 2 Type II + ISO 27001
├── Header: Controls 127 · Evidence complete 89% · Open gaps 6 · Renewal in 74 days
├── Actions: [ Auditor portal ] [ Export evidence pack ] [ Renewal checklist ] [ Assign owners ]
├── Tabs: Controls · Evidence · Requests · Gaps · Renewals · Frameworks · Settings
├── Alert: CC6.1 access review evidence due in 5 days · Owner: @alex · Overdue risk
├── Renewal banner: SOC 2 observation ends Sep 2026 · Audit kickoff target Aug 2026
└── Link: [Trust center publish queue](/designing-trust-center-and-security-documentation-ui-in-figma/) · Posture dashboard · Vendor risk| Section | Purpose |
|---|---|
| Controls | Framework-mapped control library with owners |
| Evidence | Artifacts per control; freshness and source |
| Requests | Auditor ad-hoc asks and clarifications |
| Gaps | Failed tests, missing evidence, remediation |
| Renewals | Certification timelines and milestones |
| Frameworks | SOC 2, ISO, PCI mappings and crosswalk |
Verdict: Compliance hub is audit source of truth—public trust center badges must pull active certification dates from here, not manual spreadsheets.
Control library and mapping
ControlLibrary — SOC 2 Trust Services Criteria · CC series
├── CC6.1 Logical access · Owner: Security · Evidence: Quarterly access review export
│ ├── Status: Pass · Last tested 2026-06-30 · Next due 2026-09-30
│ ├── Linked: [Access review campaigns](/designing-access-review-and-certification-campaigns-ui-in-figma/) · SSO · 2FA policies
│ └── ISO map: A.9.2.1, A.9.2.5
├── CC7.2 System monitoring · Owner: SRE · Evidence: SIEM alert rules + sample tickets
│ ├── Status: Gap · Missing: Q2 pen test remediation proof
│ └── Remediation: VM-8842 fix evidence due 2026-08-05
├── CC8.1 Change management · Owner: Engineering · Auto-ingest: GitHub PR approvals
└── Filter: [ Failed ] [ Due soon ] [ No owner ] [ Unmapped ISO ]| Control field | UI detail |
|---|---|
| Control ID | CC6.1, A.12.3.1 — framework-specific |
| Owner | Single accountable person; delegate optional |
| Test frequency | Quarterly, annual, continuous |
| Evidence types | Screenshot, log export, policy PDF, ticket link |
| Status | Pass, Fail, Gap, Not tested, N/A |
| Crosswalk | Link equivalent controls across frameworks |
| Auto-ingest | API/webhook sources reduce manual upload |
Use badges for status: Pass (green), Gap (red), Due soon (amber).
Controls should link to live product areas—access review UI, SIEM ingestion, change tickets—not orphan checklist rows.
Evidence collection workspace
EvidenceWorkspace — CC6.1 · Access reviews · Period Q2 2026
├── Required artifacts:
│ ├── [x] Access review campaign export · Uploaded 2026-07-02 · Auto from GRC API
│ ├── [x] SSO configuration screenshot · Uploaded 2026-07-02
│ ├── [ ] Terminated user deprovisioning sample · Due 2026-07-31 · Owner @alex
│ └── [x] Policy: Access Control v4.1 · PDF · Effective 2026-01-15
├── Collection period: Apr 1 – Jun 30 2026 · Observation window
├── Freshness rule: Evidence must be dated within period · Validator warns on mismatch
├── Version history: v3 replaced v2 on 2026-07-05 · Reason: wrong date range
└── [ Upload ] [ Link external ] [ Request from owner ] [ Mark N/A with justification ]| Evidence type | Collection pattern |
|---|---|
| Screenshot | Annotated; redact PII; timestamp visible |
| Log export | CSV/JSON; hash for integrity; retention note |
| Policy PDF | Version, effective date, approval signature |
| Ticket link | Jira/Linear URL; snapshot PDF if ticket ages out |
| Auto-ingest | Scheduled pull from IdP, HRIS, cloud config |
| Sample set | ”3 random terminations Q2” — auditor sampling UI |
Recurring evidence tasks use progress steppers for quarterly collection cycles.
Design freshness validator—uploading January screenshot for Q2 period triggers warning before auditor sees it.
Auditor portal (read-only)
AuditorPortal — Firm: Schellman · Engagement: SOC 2 Type II 2025–2026 · Access expires 2026-10-15
├── Welcome: 127 controls · 89% evidence complete · 4 open requests
├── Navigation: Controls · Evidence library · Requests · Sampling · Export
├── Control view (read-only): CC6.1 · All evidence for period · Download zip
├── Request thread REQ-AUD-012:
│ Auditor: "Provide additional sample for contractor access removals in June"
│ Status: Open · Assigned @alex · Due 2026-08-02
│ Reply: [ Upload ] [ Comment ] · Internal notes hidden from auditor
├── Sampling tool: Random 25 user terminations · Export manifest
└── Activity log: All auditor downloads logged · [audit log link](/designing-audit-log-and-security-activity-ui-in-figma/)| Auditor capability | Restriction |
|---|---|
| View evidence | Read-only; no edit or delete |
| Download bundles | Watermarked PDFs; logged |
| Submit requests | Thread per control or global |
| Sampling exports | Pre-defined queries only |
| Internal gaps | Hidden—auditor sees evidence or “pending” |
| Portal expiry | Auto-revoke after engagement end |
Auditor portal is not the public trust center—separate auth, time-bound, firm-specific.
Use modals for request replies; forms for structured auditor questions.
Gap remediation workflow
GapRemediation — GAP-2026-0034 · CC7.2 · Status: In progress
├── Finding: Q2 pen test critical finding VM-8842 not remediated before retest window
├── Root cause: Engineering priority conflict · Owner: @maria
├── Remediation plan:
│ ├── Fix deployed 2026-07-28 · PR #8842 · [link]
│ ├── Retest scheduled 2026-08-05 · External firm
│ └── Evidence upload due 2026-08-10
├── Risk acceptance: Not approved · Cannot close as accepted for SOC 2
├── Blocks: Trust center pen test summary update until closed
└── [ Link VM finding ] [ Link PIR ] [ Escalate to leadership ]| Gap state | UI treatment |
|---|---|
| Open | Red badge; blocks control Pass status |
| In progress | Owner, due date, plan checklist |
| Pending retest | Amber; waiting external validation |
| Closed | Evidence attached; control returns to Pass |
| Accepted risk | Rare for SOC 2; requires exec sign-off UI |
Gaps should link to vulnerability management and post-incident review when audit findings trace to incidents.
Certification renewal timeline
RenewalTimeline — SOC 2 Type II · Current period ends Sep 30 2026
├── Today: 2026-07-30 · 74 days to period end · 105 days to target report delivery
├── Milestones:
│ ├── [x] 2026-04-01 · Observation period start
│ ├── [x] 2026-06-15 · Mid-period readiness review
│ ├── [ ] 2026-08-01 · Audit kickoff meeting · Auditor: Schellman
│ ├── [ ] 2026-08-15 · Evidence lock for sampling (no new uploads without exception)
│ ├── [ ] 2026-09-01 – 2026-09-30 · Final observation month
│ ├── [ ] 2026-10-15 · Management assertion signed
│ ├── [ ] 2026-11-30 · Draft report review
│ └── [ ] 2026-12-15 · Final report · Trust center badge update
├── Parallel: ISO 27001 surveillance audit · 2026-09-20 · Shared evidence 62%
├── Dependencies: Vendor reviews complete · [vendor risk queue](/designing-vendor-risk-assessment-and-third-party-reviews-ui-in-figma/)
└── [ Export renewal checklist PDF ] [ Notify owners ] [ Sync trust center dates ]| Milestone | Owner | UI detail |
|---|---|---|
| Kickoff | GRC lead | Calendar invite link; agenda doc |
| Evidence lock | All control owners | Warning banner in evidence workspace |
| Management assertion | CEO/CISO | E-sign workflow |
| Draft report | Legal + GRC | Comment thread; redline upload |
| Final report | GRC | Triggers trust center publish queue |
| Badge expiry | Auto-calculated | Alert at 90, 60, 30 days |
Renewal countdown uses progress indicators—leadership sees one timeline per certification.
When SOC 2 and ISO run in parallel, show shared evidence percentage to avoid duplicate uploads.
Trust center publish sync
PublishQueue — Pending trust center updates from compliance
├── SOC 2 Type II badge · New period Oct 2026 – Sep 2027 · Awaiting final report
├── Pen test executive summary v5 · Replace v4 dated 2025-04 · Legal review ⏳
├── Subprocessor list · Sync from vendor registry · 3 new vendors · Auto-approved
├── Blocked: CC7.2 gap open · Pen test summary cannot claim "no critical open findings"
└── [ Preview public page ] [ Legal approve ] [ Publish to trust center ]| Sync rule | Behavior |
|---|---|
| Certification dates | Only from signed final report object |
| Pen test summary | Block publish if critical gaps open |
| Policy versions | Public summary must match approved PDF version |
| Subprocessors | Auto-sync from vendor registry with Legal filter |
| Manual override | Disabled for certification dates—Legal hard rule |
One-way flow: Compliance hub → Publish queue → Trust center—never edit badge dates directly on public site.
Comparison: continuous monitoring vs point-in-time audit
| Dimension | Continuous control monitoring | Traditional audit prep |
|---|---|---|
| Evidence | Auto-ingested on schedule | Quarterly scramble |
| Control status | Real-time Pass/Gap | Unknown until audit |
| Auditor portal | Always-ready sample exports | Zip file email chains |
| Renewal stress | Milestones tracked year-round | Panic 60 days before |
| Trust center | Publish queue gated on gaps | Stale badges after expiry |
| Tooling | GRC platform + integrations | Spreadsheets + Drive folders |
Design for continuous—recurring tasks, auto-ingest badges, and gap alerts—not a once-a-year upload frenzy.
Handoff checklist (Dev Mode)
- Framework object — SOC 2, ISO 27001; version; criteria set.
- Control — ID, owner, frequency, status, crosswalk IDs.
- Evidence artifact — type, period start/end, source (manual/auto), file hash.
- Auditor engagement — firm, access expiry, portal user list.
- Auditor request — thread ID, status, due date, visibility rules.
- Gap — linked control, remediation plan, blocks_publish flag.
- Renewal milestone — certification type, date, owner, completion state.
- Publish queue item — trust center section, Legal approval flag.
- Audit log — all auditor downloads and portal logins.
- Accessibility — control tables keyboard navigable; status not color-only.
Common mistakes
| Mistake | Why it hurts | Fix |
|---|---|---|
| Trust center dates edited manually | Expired badge public; false claims | One-way sync from compliance hub only |
| Evidence outside observation period | Auditor rejects; re-audit delay | Freshness validator on upload |
| Auditor sees internal gap notes | Damages audit relationship | Separate internal vs auditor-visible threads |
| No owner on controls | Evidence never collected | Require owner before control goes live |
| Pen test summary published with open criticals | Misrepresentation | Publish queue block until gap closed |
| ISO and SOC 2 duplicate uploads | Owner fatigue; inconsistency | Crosswalk + shared evidence library |
| Portal access never expires | Former auditor retains access | Auto-revoke on engagement end date |
| Renewal milestones only in calendar | Missed kickoff | In-app timeline with owner notifications |
| Spreadsheet parallel to GRC tool | Two sources of truth | Import once; deprecate sheet |
| Missing download audit | Cannot prove who saw what | Log every auditor export |
Recommended workflow
- Design control library with framework mapping, owners, and crosswalks.
- Build evidence workspace with recurring tasks, auto-ingest, and freshness validation.
- Create auditor portal with read-only access, request threads, and download audit.
- Spec gap remediation linking to VM, PIR, and publish queue blocks.
- Add renewal timeline with milestones per certification and shared evidence view.
- Wire trust center publish queue syncing approved dates and documents only.
FAQ
Link to compliance exports?
Compliance exports serve legal hold and customer data requests. Audit evidence serves control attestation—different retention rules; cross-link when export logs are evidence for CC series controls.
Same as security posture dashboard?
Posture dashboard is real-time control health for leadership. Compliance hub is audit-period evidence for external attestation. Posture gaps should feed compliance gaps automatically.
Access review campaigns as evidence?
Yes—CC6.x controls often require quarterly access review exports. Design one-click “Send to compliance evidence” from completed campaigns.
Multiple auditors simultaneously?
Support engagement-scoped portals—SOC 2 firm and ISO firm see shared evidence library but separate request threads and expiry dates.
Type I vs Type II UI differences?
Type I: point-in-time evidence collection, shorter timeline. Type II: observation period banner everywhere; evidence must span full period—design period selector on every artifact.
Next steps
- Design trust center and security documentation UI in Figma — public output of renewal and evidence approval
- Design security posture dashboard and compliance checklist UI in Figma — real-time gap source for audit prep
- Design compliance exports and legal hold UI in Figma — related GRC export workflows
- Design access review and certification campaigns UI in Figma — evidence source for access controls
- Design vendor risk assessment and third-party security reviews UI in Figma — vendor evidence for CC9.x and subprocessors
§ Keep reading