Dashboard
The command center: KPI tiles, quick actions to Overview, All Controls and Evidence & SLA, application quick links and the Essential Insights charts.
Continuous Benefits Compliance: Frameworks, Controls, Checks and Evidence
Framework → Control → Check → Execution → Evidence. One live engine, nine screens that read from it, and a topbar that runs it — for HIPAA, ERISA, MHPAEA, ACA, COBRA and SOC 2.
Most benefits compliance is a calendar and a shared drive. Benefits Reimagined replaces both with a catalog: each framework holds controls, each control holds executable checks, and Run Scan evaluates every check against live platform data — audit logs, filings, field integrity, session policy, approved documents. Every result appends an execution and a hash-stamped evidence row, and every dashboard, from the posture score to the framework heatmap, is a roll-up of those rows.
Framework → control → checkRun Scan · live progress6 check patternsAppend-only, hash-stamped evidenceEvidence Repository · approvals
Reimagining Benefits Compliance
"Think of it as one live engine — configure, scan, keep evidence — surrounded by dashboards that visualize its output. Consultants seed frameworks, controls and checks. An analyst picks a framework and a lookback window in the topbar and clicks Run Scan. Every check is tested against the system of record and leaves an execution and a hash-stamped evidence row behind. The Dashboard, Overview, All Controls, Posture & Heatmap, Benefits Compliance, Framework Coverage and Executions & Evidence screens are all roll-ups of those same rows. The Evidence Repository adds the documents people upload, approved through workflow. Two further pages are reference material for the board and the security team — and are labelled as such."
ConfigureFrameworks → controls → checks, seeded by consultantsScanTopbar filters + Run Scan, progressive and liveExplore & MonitorSeven screens, one set of rowsProveExecutions, hashes, the Evidence RepositoryReferenceGovernance and Security & Infra, clearly labelled
3levels in the catalog — framework, control, check — so a regulation, a requirement and its test are never the same thing
6check patterns: execution aggregation, audit-log read, live field uniqueness, session and token policy, ACA regulatory scan, approved evidence document
2rows appended per check run — an execution and a hash-stamped evidence record — never edited, never deleted
9screens in the workspace that read from those rows, plus two reference pages that do not pretend to
The Working Flow — Who Clicks What, in Order
A normal review moves through nine screens. Every one of the first eight reads from the same execution and evidence rows; the ninth is guidance, and says so.
| # | Screen | Who | What they do |
|---|---|---|---|
| 1 | Topbar | Analyst | Pick a framework (or all) and the lookback days; click Run Scan if a fresh result is needed and watch the per-framework, per-control, per-check progress. |
| 2 | Dashboard · Overview | Analyst | Scan the KPI tiles, then the heatmap, trends, spotlight alerts, insight cards, IntelliSuggest and the deadline calendar for the selected framework. |
| 3 | All Controls | Analyst | Search or filter controls by code, name or category; open a row for its latest status, description and result summary. |
| 4 | Posture & Heatmap | Analyst · GRC lead | Review the weighted posture score, per-framework scorecards, the filing-calendar strip, the framework × category grid and the panel naming which data sources fed the results. |
| 5 | Benefits Compliance | Benefits operations | Read the same rows by business domain — leave, data privacy, continuation coverage — and open a domain card for its controls. |
| 6 | Framework Coverage | GRC lead | Review the coverage matrix and automation level per framework; open a framework for control-level coverage and automation suitability. |
| 7 | Executions & Evidence | Auditor | Open the evidence drawer on any execution: check, control, result summary, correlation id, evidence type and the integrity hash. |
| 8 | Evidence & SLA | Compliance admin | Upload and maintain evidence documents in the Evidence Repository; send them for approval; read the evidence summary and audit trail. |
| 9 | Governance · Security & Infra | GRC · security stakeholder | Read three lines of defense, exceptions, vendor assurance and the infrastructure control families as reference material for board and security conversations. |
One Engine, Six Stages
Follow the workspace the way its administrators use it — from the catalog a consultant seeds, through the topbar that runs the scan, the seven screens that read the results, the two kinds of evidence, the two reference pages, and the entity on another HRIS that the same catalog covers.
Configure: frameworks, controls and checks — in that order.
Setup follows the hierarchy. A consultant grants the module, then defines one framework per regulatory or assurance scheme in scope; under each framework the named controls — PHI access logging, SPD furnished, election notice within 44 days, offer to 95% of full-time employees; under each control the checks, each with the pattern that says how it will be evaluated and the data it will read. Baseline documents — a signed business associate agreement, a SOC 2 report — go into the Evidence Repository and through the approval workflow so evidence-satisfied controls pass from day one. A pilot scan on one framework proves the loop: controls resolve to a status and Executions & Evidence shows hash-stamped rows.
What the catalog defines
- Frameworks with jurisdiction, source type and the business domains they map to
- Controls with a category, an owner and a description an auditor can read
- Checks with a pattern, a data category, expected values and the evidence type they produce
- A configurable check-definition engine — condition groups and actions — for rules-style check authoring
Why it matters
A regulation, a requirement and its test are three different things; the catalog keeps them apart so a control can gain a new check without anyone rewriting the framework.
Frameworks, controls and checks are configured through the platform's configuration services; a dedicated editing screen for the three is on the roadmap.
Topbar & Run Scan: two filters and one button, above every page.
The topbar never leaves. Its framework filter scopes the whole workspace to one scheme or all; its lookback filter sets how many days of execution history the rollups read; and Run Scan opens a modal that starts a background scan and polls it a few times a second, painting each framework, then each control, then each check as it completes. Each check is evaluated by its pattern, and each evaluation appends exactly two rows — an execution with status, result summary and correlation identifier, and an evidence record with a masked value and an integrity hash. When the last framework reports complete or failed, the dashboards already reflect it. Closing the modal stops the polling; the run continues server-side.
What the analyst controls
- Scope — one framework or all — and the lookback window every page will use
- When to run: on demand before a review, or rely on the progressive scanner in the background
- Which failed control to open first — the modal lists them as they turn red
- Nothing else: a scan never edits the catalog, the history or the evidence
Why it matters
A status is the output of a test on your own data, not a status somebody typed into a tracker.
Changing the lookback re-reads existing history; only Run Scan produces new executions.
Explore & Monitor: seven screens, one set of rows.
Dashboard is the command center — KPI tiles, quick actions to Overview, All Controls and Evidence & SLA, and the Essential Insights charts. Overview is the working dashboard: heatmap with score and refresh, trends, spotlight alerts, insight cards, IntelliSuggest, the deadline calendar and the execution model, all scoped to the selected framework. All Controls is the catalog with live status — stat cards, a server-paged searchable list, a detail modal per row. Posture & Heatmap is the executive scorecard: the weighted score, per-framework scorecards, the filing-calendar strip, the framework × category grid and the scan-sources panel. Benefits Compliance slices the same rows by business domain; Framework Coverage by framework, with a coverage alert banner and an automation-level breakdown.
What each screen answers
- Dashboard and Overview — what changed, what needs attention this week, what is due
- All Controls — is this specific requirement passing, and what did the last check find
- Posture & Heatmap — where are we weakest, by framework and by category, and which sources fed the result
- Benefits Compliance and Framework Coverage — how does it look by domain, and how much of each framework is still manual
Why it matters
Because every screen is a roll-up of the same execution rows, they agree with each other by construction — a board hears a score and an auditor opens the same cell.
Not applicable is a fact about the window — no executions found — not a judgment that a control does not apply; widen the lookback or run the scan.
Executions & Evidence: the audit trail and the repository.
Two kinds of evidence live in the workspace. Check evidence is written automatically with every execution — a masked or safe value and an integrity hash of what was observed, never the raw protected value. Executions & Evidence lists every execution, paged and searchable by framework, and the drawer on any row shows the check, the control, the result summary, the correlation identifier, the evidence type and the hash in monospace, with the reminder that rows are append-only. Evidence & SLA holds the documents people upload — a SOC 2 report, a signed business associate agreement, a policy — linked to the framework and control they satisfy, moved from Draft to In Review to Approved or Rejected through the workflow engine, with an evidence summary by status, SLA metrics and the repository's own audit trail.
What the auditor gets
- A paged, searchable list of executions by framework, with the evidence drawer one click away
- An integrity hash on every evidence row, and a masked value instead of the observation itself
- The repository's audit trail: create, update, submit, approve, reject — with who and when
- Evidence summary by status — Draft, In Review, Approved, Rejected, Expiring — and SLA metrics
Why it matters
The difference between "we have a BAA somewhere" and "here is the approved BAA, its control, and the scan that passed because of it."
Only Draft, Approved or Rejected documents can be submitted; a document already In Review is blocked with a message, so two approvals never race. An approved, unexpired document auto-passes its control on the next scan.
Reference pages: the governance narrative, labelled as such.
Two pages under the Benefits group serve board and security conversations rather than the scan. Governance presents the three lines of defense, automation suitability, the certification lifecycle, an exception registry, a vendor assurance table and workflow triggers; Security & Infra presents the control families of the platform's security blueprint — secure engineering, vulnerability management, cryptography, network and perimeter, identity, performance and availability, data storage and vendors — with a detail modal on every item. They are guidance beside the live views, not scan output, and the workspace says so.
How to use them
- Walk a board through three lines of defense and the exception registry as talking points
- Give a security reviewer the control-family narrative behind the SOC 2 framework
- Use the certification-lifecycle and exception panels to agree the process before it is automated
- Read the live posture from the seven screens before it; read these two afterwards
Why it matters
Guidance and evidence are different things; a workspace that keeps them apart is one an auditor trusts.
Certification cycles, exceptions and tickets are described on these pages; creating those records from them is on the roadmap.
SAP-native. One catalog for every entity.
Checks read the Benefits Reimagined data model — audit and access logs, execution history, ACA filings, field values, session and identity policy, approved documents — and that model is the same whether the employee arrived from SAP SuccessFactors Employee Central in real time or from Workday, UKG, ADP, Dayforce or Paycom through the HRIS Sync control plane. A field-uniqueness check on the employee table covers the acquired plant and the headquarters alike; an ACA check runs against the filing year for every ALE member; the posture score is one number for the tenant.
What stays the same across systems
- One framework catalog, one scan engine, one evidence trail for every entity
- Audit logs from every module — enrollment, billing, workflow, integrations, jobs, reconciliation — feed the audit-category checks
- The HRIS a record came from is metadata on the record, not a second compliance program
- Runs on SAP BTP or AWS with SAP HANA or PostgreSQL — the same platform as ACA, QMCSO and enrollment
Why it matters
A merger should add employees to the posture score, not a second set of controls.
The ACA checks call the same rules the ACA module files with, so the filing and the control never disagree.
How a Check Is Evaluated — the Patterns Behind the Engine
A check names its pattern and its data source, so one catalog can hold a live database scan, an audit-log read and an approved document side by side. Every evaluation appends one execution row and one hash-stamped evidence row; a control's status is the roll-up of its checks, a framework's the roll-up of its controls.
| Check pattern | How it is evaluated | What it proves |
|---|---|---|
| Default | Aggregates existing execution rows over the lookback window. | A control whose checks already run inside other modules — the scan summarises them. |
| Audit category | Reads the platform's audit transaction and access logs directly. | PHI access logging; who read what, when. |
| Integrity · identity · unique | A live field-uniqueness scan against the actual table. | One Social Security number per employee; one identifier per record. |
| Credential · authentication | A live scan of session-timeout and token-lifetime policy. | Session timeout ≤ 15 minutes; token lifetime within policy; MFA enforced. |
| PHI scope | Executions are logged from the masking service by mask type — masking or redaction. | Minimum-necessary handling of protected fields in exports and screens. |
| ACA regulatory | A live scan against the current filing tax year, calling the ACA module's own rules. | Offer to 95% of full-time employees; affordability under the configured safe harbor. |
| Approved evidence | An approved, unexpired document in the Evidence Repository for the control. | Signed BAA on file; SOC 2 report current; comparative analysis approved — auto-pass on the next scan. |
Nine Screens, One Set of Rows
Every screen from Dashboard to Evidence & SLA reads the execution and evidence rows the scan writes; the topbar's framework and lookback filters follow you to each of them.
Overview
The working dashboard behind the first quick action: framework selector, heatmap with score and refresh, trends, spotlight alerts, insight cards, IntelliSuggest, deadline calendar, execution model.
All Controls
The control catalog with live status: stat cards for total, passed, failed, not applicable and score; a server-paged list searchable by code, name or category; a detail modal per row.
Posture & Heatmap
The executive scorecard: weighted posture score, status tiles, per-framework scorecards, the filing-calendar strip, the framework × category grid and the scan-sources panel.
Benefits Compliance
The same engine sliced by business domain — leave, data privacy, continuation coverage — with pass, fail, partial and not-applicable counts per card and a detail modal listing the domain's controls.
Framework Coverage
One card per framework — jurisdiction, source type, domains, control count, automation level — behind a coverage alert banner, with a detail modal on control-level coverage and automation suitability.
Executions & Evidence
The immutable audit trail: a paged, searchable execution list and a slide-in drawer showing check, control, result summary, correlation id, evidence type and the integrity hash.
Evidence & SLA
The governance workflow: evidence summary by status, SLA metrics, the Evidence Repository with upload, update, send-for-approval and delete, and the chronological audit trail.
Governance · Security & Infra
Reference material for board and security stakeholders — three lines of defense, exceptions, vendor assurance, certification lifecycle; the blueprint's control families — presented as guidance beside the live views.
Compliance Trackers vs. a Control Plane
Benefits vendors sell deadline dashboards and services; security vendors sell continuous controls monitoring for SOC 2 and ISO. Here is what changes when the two ideas meet inside the benefits platform.
| Moment | Compliance tracker or outsourcer | Benefits Reimagined Compliance |
|---|---|---|
| What a framework is | A calendar of deadlines and a folder of policies. | A catalog of controls and executable checks, with domains mapped over it. |
| How a status is set | Someone marks the task complete. | A check runs against audit logs, filings, fields, policy or an approved document. |
| How often | Annually, before the audit. | On demand or continuously — Run Scan with live progress; rollups over a lookback window. |
| What the score means | A count of completed tasks. | A weighted pass rate across applicable controls, with a heatmap by framework and category. |
| Where the evidence is | A shared drive; screenshots at audit time. | Appended with every execution — masked value plus integrity hash — and a repository for documents. |
| Who approves a document | Whoever has the folder. | The workflow engine: Draft → In Review → Approved or Rejected, with an audit trail. |
| Guidance vs. evidence | Mixed together in one binder. | Kept apart: seven live screens, two reference pages labelled as such. |
| An auditor asks | "Let me find it." | The evidence drawer: check, control, result, correlation id, hash. |
Athena on the compliance desk
Ask Why a Control Failed Before the Auditor Does
The Overview carries spotlight alerts, insight cards and IntelliSuggest, and the workspace has an Athena for administrators that reads the catalog, the executions and the evidence. It explains a failed or partial control in plain language, names the check and the data it read, and drafts the remediation note or the repository entry — while running a scan, approving a document and changing the catalog stay with people.
- "Why is COBRA election notice partial?" — the execution: two notices in the window exceeded 44 days, with the cases named
- "What would move the posture score above 90?" — the failing and partial controls ranked by weight, with the cheapest fixes first
- "Do we have an approved BAA for every vendor?" — the repository by control, with expiring documents flagged
- "Which data sources fed this scan?" — the scan-sources panel in words: audit logs, live field checks, session policy, ACA filings, approved documents
- "Draft the remediation note for the failed session-timeout check" — a note for the control's owner, ready to keep or edit
Why is the COBRA election-notice control partial this week?
Athena · from the latest executionThe check "election notice within 44 days" aggregates the notice-timing executions in the 90-day window. Forty-one notices were issued; thirty-nine were inside 44 days of the qualifying event, two were not — 46 and 51 days, both September terminations at Northwind Logistics where the termination reached the platform late from Workday. The control is partial, not failed, because the pass rate is above the partial threshold. The evidence rows carry the masked case identifiers and the hashes.
Open the two casesShow the sync delay
What would move the posture score above 90?
AthenaTwo things, by weight. Approve the MHPAEA comparative-analysis document that is In Review — its control fails today only because no approved document exists, and approval auto-passes it on the next scan. Then fix the termination-feed delay at Logistics so the COBRA control returns to pass. Together they take the weighted score from 88 to about 92. I can draft the reminder to the approver; I don't approve documents or run the scan.
Draft the reminderOpen Evidence Repository
Ask about any control, execution, document or deadline…
What the Compliance Framework Changes
From a calendar to a catalog
Deadlines are the visible part; controls and checks are what an auditor tests — the catalog holds both.
From self-attestation to tests
A status is the output of a check on your own data — audit logs, filings, fields, policy — not a box somebody ticked.
From point-in-time to continuous
Run Scan on demand or let the progressive engine run; rollups read a lookback window, not last year's binder.
From screenshots to evidence
Every execution appends a hash-stamped, masked evidence row — verifiable, never edited, never raw PHI.
From a folder to a repository
SOC 2 reports, BAAs and policies linked to controls, approved through workflow, expiring on schedule.
From one law to the whole estate
HIPAA, ERISA, MHPAEA, ACA, COBRA and SOC 2 in one posture score — by framework, by category, by benefits domain.
Four Stories the Workspace Is Built For
The same execution and evidence rows serve every audience without translation. Here is how the workspace is used on an ordinary week, and how each story ends in a record rather than a recollection.
- The weekly review — open Dashboard for the tiles; pick all frameworks in the topbar and Run Scan; wait for every framework to complete; open All Controls, filter by category and read a failed control's result summary; open Executions & Evidence, find its latest execution and confirm the integrity hash in the drawer
- A new SOC 2 report — open Evidence & SLA; upload the document with notes, linked to the framework and control it satisfies; send it for approval; the approver acts in the workflow engine; once approved, every check whose control it covers passes on the next scan
- A domain review, not a framework review — open Benefits Compliance; click a domain card such as leave administration; read its controls' latest status in the detail modal — the same rows as All Controls, organised for the people who run the work
- The board narrative — open Governance for three lines of defense and the exception registry as talking points, and Security & Infra for the control-family narrative — presented as reference material, with the live posture read from the seven screens before it
The 2026 Calendar on the Posture Page
The filing-calendar strip on Posture & Heatmap and the deadline calendar on Overview carry these dates per framework; the checks under each control produce the evidence that the work behind the date was done.
Form 1095-CMar 2 · Mar 31furnish statements to employees; e-file 1094-C / 1095-C with the IRS — the ACA module produces both
RxDCJune 1, 2026prescription-drug data collection for the 2025 reference year, submitted through CMS HIOS
Form 5500 · PCORIJuly 31, 2026annual return for calendar-year plans (extension to Oct 15) and the PCORI fee on Form 720 — $3.84 per covered life
Medicare Part DOct 15creditable-coverage notice to Medicare-eligible individuals; CMS disclosure within 60 days of the plan year
Gag clauseDec 31annual prohibition-compliance attestation for group health plans and issuers
COBRA notices14 · 44 daysadministrator election notice within 14 days of notification; 44 days when the employer administers
MHPAEAStill requiredCAA comparative analysis of NQTLs remains enforceable; 2024-rule-only provisions paused (FAB 2026-03, Sept 8, 2026)
HIPAA Security Rule2027proposed update — MFA, encryption, asset inventory, 72-hour restoration — now expected to finalize in 2027
Dates and figures from IRS, DOL EBSA, CMS and Federal Register sources as of September 2026, including DOL Field Assistance Bulletin 2026-03 on mental-health parity enforcement. Informational only — confirm your obligations with counsel.
Run One Scan. Read Your Posture. Open the Evidence.
Bring the frameworks you are held to. We'll seed them as controls and checks against a sample tenant, run the scan while you watch, walk the heatmap to a failing control, open its evidence drawer, and approve one document to see the control pass.
HIPAA · ERISA · MHPAEA · ACA · COBRA · SOC 2Append-only evidenceIntegrity hashes · no raw PHIWorkflow-approved documentsSAP BTP or AWSSAP HANA or PostgreSQLSOC 2ISO 27001GDPR · PIPEDA
Compliance Framework FAQs
A calendar tells you when something is due; a checklist asks someone to tick a box. In Benefits Reimagined a framework is a catalog — a regulatory or assurance scheme such as HIPAA or ERISA, the controls it requires, and the executable checks that test each control against the platform's own data. The result is an execution record with a status, a result summary and hash-stamped evidence, produced by Run Scan and rolled up into a posture score.
The catalog is defined per tenant. Implementations typically seed HIPAA, ERISA, MHPAEA, ACA, COBRA and SOC 2, with business-facing domains such as data privacy, leave administration and continuation coverage mapped over them so benefits teams can read posture by the work they do. Frameworks, controls and checks are configured by consultants during implementation and extended as regulations change.
The button in the topbar opens a modal that starts a background scan and polls it every few hundred milliseconds, painting each framework, control and check as it completes. Each check is evaluated by its pattern — aggregation of recent executions, a direct audit-log read, a live field-uniqueness scan, a session-timeout or token-lifetime policy test, an ACA regulatory check against the filing year, or an approved document in the Evidence Repository — and every evaluation appends one execution row and one evidence row. Closing the modal stops the polling, not the scan.
They sit in the topbar above every page and follow you through the whole workspace. The framework filter scopes every dashboard, list and modal to one scheme or to all of them; the lookback filter sets how many days of execution history the rollups consider. Changing the lookback re-reads existing history — it does not re-scan unless you click Run Scan.
It is a weighted pass rate across applicable controls. A control's status is the roll-up of its checks' latest executions inside the lookback window; a framework's status is the roll-up of its controls. The heatmap crosses framework by control category. A cell marked not applicable means no executions were found in the window — not that the control does not apply to you.
Every check execution writes an evidence row holding a masked or safe value and an integrity hash of what was observed — never the raw protected health information. Rows are appended, never edited or deleted, and each scan reads only within its lookback window; it never rewrites history. In the evidence drawer the auditor sees the check, the control, the result summary, the correlation identifier, the evidence type and the hash.
Check evidence is written automatically by the scan. The Evidence Repository holds documents people upload — a SOC 2 report, a signed business associate agreement, a policy — linked to the framework and control they satisfy. A document moves from Draft to In Review to Approved or Rejected through the platform's workflow engine; only Draft, Approved or Rejected documents can be submitted, and an approved, unexpired document lets its control pass on the next scan without a separate execution.
Both read the same execution rows. Benefits Compliance groups them by business domain — leave, data privacy, continuation coverage — with a card per domain and a detail modal listing its controls. Framework Coverage groups them by framework, with a card per scheme showing jurisdiction, source type, domains, control count and automation level, a coverage alert banner, and a detail modal with control-level coverage and automation suitability.
No. They are reference material: three lines of defense, automation suitability, certification lifecycle, exception registry, vendor assurance and workflow triggers on the Governance page; secure engineering, vulnerability management, cryptography, network, identity, availability and data-storage control families on Security & Infra. They are presented as governance guidance for board and security stakeholders; they do not create cycles, exceptions or tickets today.
No. It gives them and you the same evidence. Counsel interprets; the TPA administers; the ACA module files. What changes is that "can we show it?" is answered by an execution record and a repository document rather than a search through mailboxes.
Yes. Checks run against the Benefits Reimagined data model — audit logs, execution history, ACA filings, field values, session policy, approved documents — which is the same for every entity. On SAP SuccessFactors that data is native; for Workday, UKG, ADP, Dayforce, Paycom or any other HRIS, HRIS Sync fills the same canonical fields, so one catalog and one posture score cover the whole tenant.
Every Control Tested. Every Result Kept.
Benefits compliance run the way security teams run theirs — a catalog, a scan and tamper-evident evidence — inside the platform that holds the data, on SAP SuccessFactors today and on whichever HRIS your next entity brings.