---
title: "Compliance calendar: every recurring date in one place"
canonical: "https://auditbadger.com/blog/compliance-calendar-every-recurring-date-in-one-place/"
last-updated: "2026-10-09"
---

# Compliance calendar: every recurring date in one place

By Maciej • Published 2026-10-08 • 8 min read • Categories: Product Updates, Compliance Governance, Soc2, ISO

Created with AI assistance. AuditBadger retains editorial control and responsibility.

**TL;DR:** AuditBadger now has a compliance calendar: one list of every due date from seven areas (policy reviews, vendor reviews, continuity tests and exercises, ISO 27001 management reviews, risk reviews, NIS2 statutory obligations and recurring meetings), overdue items first, then the next 12 months grouped by month. Account admins set an expected cadence for security oversight, risk review and change review meetings (monthly, quarterly, every six months or yearly), with a suggestion and its reasoning; periods follow the calendar, grace days are configurable, and meetings recorded in AuditBadger count automatically. Overdue or soon-due meetings show on the dashboard with a Record meeting button and in the Monday digest. Each person can subscribe through a private iCal feed that carries only a title, a date and a link. Meeting evidence now shows expected cadence, missed periods and the next expected date, and the experimental consistency check flags policies that state a different cadence, offering to fix either the text or the setting. It is advisory: nothing changes a control status or readiness score, and it is included in the flat subscription.

Compliance is mostly a pile of dates. Review this policy every year. Test the continuity plan. Re-check that vendor. Hold the security meeting every quarter (and write down what you decided). None of it is hard. All of it is easy to forget, and the auditor always notices the gap. AuditBadger now has a compliance calendar: every one of those dates in one list, what is overdue at the top, and a private feed so your own calendar app can remind you.

![](https://auditbadger.com/assets/compliance-calendar-overview-1d11aa39.png)
_The compliance calendar: one overdue security oversight meeting, then everything due in October and November_

## Why does a compliance program need a calendar?

Auditors rarely fail you for a missing policy. They fail you for a policy nobody followed: the review that never happened, the meeting with no minutes, the vendor last checked two years ago. Every framework is full of recurring promises like these, and they live in different places. Policy review dates sit on the policies. Vendor reviews sit on the vendors. The quarterly security meeting usually sits in someone's head.

We know the feeling. Our own SOC 2® Type II observation window ran from 27 March to 27 June 2026, on AuditBadger, with no external consultants, and a Type II auditor samples from the whole window. A recurring task that quietly slipped for one quarter is exactly the kind of hole they find. The calendar turns "we do this regularly" into dates you can actually see, and makes the misses visible to you before they are visible to the auditor.

## What shows up in the list

The calendar pulls dates from the records you already keep, so there is nothing new to maintain:

- **Policy reviews:** the review date of each published policy. A draft you are still editing does not count.
- **Vendor reviews:** when each active vendor is due for its next review.
- **Continuity tests:** the next test of each active plan, plus exercises that are planned or in progress.
- **Management reviews:** your next ISO 27001 management review, or the next review date the last one set.
- **Risk reviews:** the review date of every open risk, accepted risks included (accepting a risk is not the same as forgetting it).
- **Statutory obligations:** open duties from your NIS2 entity classification. NIS2 support is in early access.
- **Recurring meetings:** security oversight, risk review and change review meetings, on the cadence you set.

Overdue items come first, then the next 12 months grouped by month. Each row links to the record behind it, and you can filter by area. Everyone sees only the dates of records they are allowed to open.

## How often should the security meeting happen?

That one is your call, and now it is a setting. On the Recurring activities tab of the Compliance settings, an account admin sets how often security oversight, risk review and change review meetings should happen: monthly, quarterly, every six months or yearly. AuditBadger suggests a cadence from common practice for your frameworks and says why. Change review, for example, gets a monthly suggestion with the honest explanation that frameworks ask for approval of each significant change and name no meeting interval at all.

![](https://auditbadger.com/assets/compliance-calendar-cadence-settings-e678940a.png)
_Setting the cadence for change review meetings, with the suggestion and the reason behind it_

A few details that matter more than they look:

- Periods follow the calendar. Quarterly means one meeting per calendar quarter, not one every 90 days from whenever you last remembered.
- Grace days are yours to choose, so a meeting held a few days late still counts for its period. The defaults run from 7 days for monthly to 30 for half-yearly and yearly.
- Meetings you record in AuditBadger fill their period automatically.
- There is one cadence per activity for the whole account, and only admins can change it.

## The miss lands on your to-do list

When a meeting is overdue, or due within 30 days, it shows up on your dashboard with a Record meeting button, and in the Monday digest. We did not add a new stream of reminder emails. You already have enough of those, and you have probably learned to ignore most of them.

![](https://auditbadger.com/assets/compliance-calendar-dashboard-8a7f291f.png)
_An overdue security oversight meeting as step one of today's path on the dashboard_

If you prefer the work queue layout of the dashboard, the same item sits at the top of the queue, ordered by deadline.

![](https://auditbadger.com/assets/compliance-calendar-work-queue-8694b69f.png)
_The same overdue meeting at the top of the work queue layout_

## Subscribe in Google Calendar, Outlook or Apple Calendar

Most of us live in a calendar app, not in a compliance tool. So every person gets one private iCal link. Paste it into Google Calendar, Outlook or Apple Calendar once, and compliance dates appear next to your other meetings.

![](https://auditbadger.com/assets/compliance-calendar-subscribe-809e9dea.png)
_The private iCal link for your calendar app, with options to create a new URL or delete the subscription_

We were careful about what leaves AuditBadger here. Each event carries a title, a date and a link back, and nothing else: no descriptions, no evidence, no record details. The feed holds only what its owner can see. Anyone who has the URL can read it, so treat it like a password. Create a new URL whenever you like and the old one stops working at once. One honest caveat: we ask calendar apps to refresh every hour, and Apple Calendar and Outlook listen. Google Calendar keeps its own schedule.

## Meeting evidence that knows the cadence

The meeting evidence for your controls now shows the expected cadence, the missed periods in the last 12 months and the date the next meeting is expected. That is the question an auditor asks about oversight meetings, answered before they ask it. It includes the miss, too, because a gap you can explain is far better than a gap the auditor discovers.

![](https://auditbadger.com/assets/compliance-calendar-meeting-evidence-a3c046e5.png)
_Meeting evidence with expected cadence, missed periods and the next expected date_

If you want the longer version of what auditors look for in reviews, [policy review evidence: what auditors check beyond the text](/blog/policy-review-evidence-what-auditors-check-beyond-the-text/) covers the policy side, and our [guide to ISO 27001 clause 9](/blog/iso-27001-clause-9-performance-evaluation-monitoring-internal-audit-and-management-review/) covers management review at planned intervals.

## When the policy and the setting disagree

This happens to everyone. Your Information Security Policy says the security committee meets every six months, because someone wrote it before anyone decided on a cadence. Your settings now say quarterly. An auditor reading both will ask which one is true.

The document consistency check spots the disagreement and offers two fixes. Change the policy text to match what you actually do, or change the setting to match what the policy promises. You pick one. A text fix shows the diff first and creates a new draft version of the policy, so nothing gets edited behind your back. The consistency check is still experimental, so expect it to get sharper.

![](https://auditbadger.com/assets/compliance-calendar-consistency-fix-9a4dbeec.png)
_A policy and a setting that disagree, with a fix for the document and a fix for the record_

## Which framework requirements does it help with?

The calendar does not make you compliant on its own. It helps you keep the recurring promises your frameworks ask for, and show that you kept them:

- **Management oversight of security:** SOC 2 CC1.2, CC4.1 and CC4.2, and ISO 27001 clause 9.3 management review.
- **Regular risk reviews:** SOC 2 CC3.2, ISO 27001 clause 8.2 (risk assessment at planned intervals) and risk register reviews.
- **Change review:** SOC 2 CC8.1 and ISO 27001 Annex A 8.32.
- **Policy reviews at planned intervals:** ISO 27001 Annex A 5.1.
- **Supplier monitoring:** ISO 27001 Annex A 5.19 to 5.22 and SOC 2 CC9.2.
- **Continuity testing:** ISO 27001 Annex A 5.30 and SOC 2 A1.3.
- **Statutory deadlines:** NIS2 obligations from your entity classification.

Post-incident reviews (SOC 2 CC7.4 and CC7.5, ISO 27001 Annex A 5.27) follow incidents rather than the calendar, so they have no cadence.

## What it does not do

- It is advisory. Nothing here changes a control status, your readiness score or evidence acceptance. An overdue meeting is a nudge, not a verdict.
- No reminder emails. The dashboard, the Monday digest and your own calendar app carry the dates.
- Training due dates are not in the calendar. They are personal, and there are a lot of them.
- It is a list grouped by month, not a month grid (yet).
- The cadence is set once for the whole account, not per project, and a meeting from any project fills its period.

## How to start

Open Compliance, then Calendar. If you are an admin, Recurring activity settings is one click away: accept the suggestions or set your own cadence. Then press Subscribe and paste the link into your calendar app. The whole thing takes about as long as the meeting you were about to forget (less, actually).

It is part of the flat subscription, not an add-on, and the full capability list is on the [compliance calendar feature page](/features/compliance-calendar/). If you are working out a rhythm for everything else between audits, [how to maintain SOC 2 compliance year-round](/blog/how-to-maintain-soc-2-compliance-year-round-monitoring-checklist/) pairs well with it.


## Frequently asked questions

### How often should internal policies be reviewed?

At minimum, annually for stable policies. But fast-changing areas—data privacy, AI usage, security—should be reviewed quarterly. Additionally, trigger events should prompt immediate review: regulatory changes, security incidents, new tool adoption, significant team growth, or audit findings. Set calendar reminders or use automated compliance tools that flag policies approaching their review date.

### What is a compliance calendar and why do small teams need one?

A compliance calendar consolidates all recurring compliance activities—policy reviews, vendor assessments, continuity tests, risk reviews, and security meetings—into one prioritized list showing what's overdue first. AuditBadger's compliance calendar automatically pulls dates from your existing records and integrates with your personal calendar app, so small teams can track every SOC 2 and ISO 27001 deadline without extra maintenance or missing audit requirements.

### How often should security oversight meetings happen for SOC 2 and ISO 27001?

The frequency depends on your organization's size and framework requirements, but AuditBadger recommends quarterly security oversight meetings as common practice for most SOC 2 and ISO 27001 programs. You can configure the cadence (monthly, quarterly, semi-annually, or yearly) in your compliance settings, and AuditBadger will automatically track overdue meetings and remind you through your dashboard and Monday digest.

### Can compliance calendar software help prevent SOC 2 audit failures?

Yes—auditors typically fail organizations not for missing policies but for policies nobody followed, like skipped reviews or forgotten meetings. AuditBadger's compliance calendar surfaces these gaps before auditors do by tracking policy review dates, vendor assessments, continuity tests, and recurring meetings in one place with overdue items at the top, making missed obligations visible to you first.

### How much does compliance calendar automation cost compared to spreadsheets?

AuditBadger includes compliance calendar automation as part of its flat $250/month GRC platform with unlimited users, eliminating the need to manually track dates in spreadsheets across policies, vendors, risks, and meetings. The calendar automatically updates from your existing records and syncs with personal calendar apps, saving hours of manual tracking while reducing the risk of missed deadlines that consultants charge thousands to remediate.