Important documents and decisions in the ISMS are approved, for example the scope, policies or the acceptance of risks. In Varmo, the four-eyes principle applies without exception. This article explains how you set up approvals, assign an assignee and their deputies, and why submitting is sometimes locked.

Before you start

  • Approvers are always functional roles, never individual people outside a role. Whoever approves therefore needs a functional role and counts as a user of your plan.
  • The Set up approvals page is visible to people who may see members. Whoever may assign functional roles can specify people; by default, the ISMS managers. The deputy deadline is changed by whoever may edit functional roles.
  • Approvals are included in all plans.

Who approves what

  • Scope and Statement of Applicability: top management, by default the functional role Top management.
  • Risk acceptance: risks that the risk owner may not accept alone under your risk acceptance criteria are approved by the approver specified there, see Setting the risk methodology and acceptance criteria.
  • Policies: the approvers in the approval workflow of the respective document, see Managing policies with an approval workflow. This also applies to the information security policy. Under ISO/IEC 27001 (clause 5.2), top management establishes the policy: add the functional role Top management to its approval workflow.
  • Protection requirements assessment, baseline check and exceptions: the approvers in the approval workflow that you set under ISMS settings › Assets.
  • Documents & evidence: people with the permission to approve documents.

How to do it

Specifying top management

  1. Open ISMS settings › Organisation & roles › Set up approvals.
  2. For each functional role of top management, choose a person under Person (e.g. from management).
  3. Click Assign.

If a person has already been assigned to a functional role, the page shows “Assigned: …”. You then add or change further people under Functions & roles.

If Varmo shows a segregation of duties conflict, for example because the person also manages accounts, briefly record a justification. A justification is prepared for small organisations. Adapt it to your actual compensating measures (e.g. annual access review, check by a third party): an auditor will ask how you compensate for the missing separation (ISO/IEC 27001, Annex A 5.3).

Setting the approval workflow of a policy

  1. Set the approval workflow when creating the policy or change it on the document's page.
  2. Use Add approver to add one or more functional roles. Approvers of the same step sign independently of each other; the next step begins once all approvers of the previous step have signed.
  3. If the functional role has several people, you can optionally choose an assignee under Assignee instead of All members of the functional role.

Assignee and deputies

If an assignee is specified, only they receive the task. The other members of the functional role can sign as deputies

  • as soon as the deadline has passed (default 14 days), or
  • as soon as the assignee hands over with Hand over to deputies, for example before going on holiday.

You set the deadline under Set up approvals in the Deputies for assignees card, between 1 and 90 days. It applies immediately, including to ongoing approvals. If the assignee is no longer in the functional role or has been deactivated, all members can sign immediately. Assignees are currently available in the approval workflow of policies.

Four-eyes principle

  1. Person ACreate and submit

    Varmo checks beforehand whether someone else can approve.

  2. ApproverReview and sign

    Members of the functional role, never person A.

  3. ValidWith the last required signature.
Rejected

The item returns to person A with a justification.

Assignee does not respond (policies)

After the deadline (default 14 days) or after handover, the deputies sign.

Nobody else can approve

Submitting is locked until the functional role has another person.

Approval with the four-eyes principle

Person A creates and submits. The task goes to the approver, a functional role whose members other than person A sign. With the last required signature, the version is valid. If it is rejected, the item returns to person A with a justification. For policies with an assignee, the deputies sign after the deadline has passed or after handover. If nobody other than those involved could approve, submitting is locked.

  • Whoever creates or submits something never approves it themselves, not even as Tenant Admin.
  • You cannot assign functional roles to yourself. That is why you always choose another person under Set up approvals.
  • Submitting is locked if nobody could approve. If an approver consists only of you or the other people involved, Varmo shows “Cannot submit” and names the functional role. Otherwise the item would be stuck.

What happens next

  • Submitted approvals appear for the approver under My tasks. The box at the top of the page shows everyone involved whose turn it is, see Using My tasks and the team queue.
  • If an approver has no members, the workflow waits. Whoever assigns functional roles receives the task Staff functional role “…”. Tenant Admins do not step in automatically.

Frequently asked questions

There are only two of us. Does that work?

Yes. It is enough that a person other than the one who created or submitted approves. Approvals of top management are then handled by the managing director, for example, while you run the ISMS.

A document has already been approved outside Varmo.

For the scope, policies and the Statement of Applicability, you adopt the existing approval for the first version, stating who approved it and when, with evidence (PDF). The four-eyes principle also applies here: the approver confirms the adoption in Varmo, and whoever recorded it does not confirm it themselves. See Setup step by step.

The assignee has left the organisation.

Then all members of the functional role can sign. Whoever may change the approval workflow receives a task to specify a new person.